nokogiri 1.9.1 → 1.15.3

data/LICENSE.md

@@ -1,32 +1,9 @@
-(The MIT License)
+The MIT License
 
-Copyright (c) 2008 - 2018:
+Copyright 2008 -- 2023 by Mike Dalessio, Aaron Patterson, Yoko Harada, Akinori MUSHA, John Shahid, Karol Bucek, Sam Ruby, Craig Barnes, Stephen Checkoway, Lars Kanis, Sergio Arbeo, Timothy Elliott, Nobuyoshi Nakada, Charles Nutter, Patrick Mahoney.
 
-* [Aaron Patterson](http://tenderlovemaking.com)
-* [Mike Dalessio](http://mike.daless.io)
-* [Charles Nutter](http://blog.headius.com)
-* [Sergio Arbeo](http://www.serabe.com)
-* [Patrick Mahoney](http://polycrystal.org)
-* [Yoko Harada](http://yokolet.blogspot.com)
-* [Akinori MUSHA](https://akinori.org)
-* [John Shahid](https://github.com/jvshahid)
-* [Lars Kanis](https://github.com/larskanis)
+Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
 
-Permission is hereby granted, free of charge, to any person obtaining
-a copy of this software and associated documentation files (the
-'Software'), to deal in the Software without restriction, including
-without limitation the rights to use, copy, modify, merge, publish,
-distribute, sublicense, and/or sell copies of the Software, and to
-permit persons to whom the Software is furnished to do so, subject to
-the following conditions:
+The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
 
-The above copyright notice and this permission notice shall be
-included in all copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,
-EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
-MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
-IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
-CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
-TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
-SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

data/README.md

@@ -1,89 +1,168 @@
+<div><img src="https://nokogiri.org/images/nokogiri-serif-black.png" align="right"/></div>
+
 # Nokogiri
 
-## Description
+Nokogiri (鋸) makes it easy and painless to work with XML and HTML from Ruby. It provides a sensible, easy-to-understand API for [reading](https://nokogiri.org/tutorials/parsing_an_html_xml_document.html), writing, [modifying](https://nokogiri.org/tutorials/modifying_an_html_xml_document.html), and [querying](https://nokogiri.org/tutorials/searching_a_xml_html_document.html) documents. It is fast and standards-compliant by relying on native parsers like libxml2, libgumbo, and xerces.
+
+## Guiding Principles
+
+Some guiding principles Nokogiri tries to follow:
+
+- be secure-by-default by treating all documents as **untrusted** by default
+- be a **thin-as-reasonable layer** on top of the underlying parsers, and don't attempt to fix behavioral differences between the parsers
+
+
+## Features Overview
+
+- DOM Parser for XML, HTML4, and HTML5
+- SAX Parser for XML and HTML4
+- Push Parser for XML and HTML4
+- Document search via XPath 1.0
+- Document search via CSS3 selectors, with some jquery-like extensions
+- XSD Schema validation
+- XSLT transformation
+- "Builder" DSL for XML and HTML documents
+
+
+## Status
+
+[![Github Actions CI](https://github.com/sparklemotion/nokogiri/actions/workflows/ci.yml/badge.svg?branch=main)](https://github.com/sparklemotion/nokogiri/actions/workflows/ci.yml)
+[![Appveyor CI](https://ci.appveyor.com/api/projects/status/xj2pqwvlxwuwgr06/branch/main?svg=true)](https://ci.appveyor.com/project/flavorjones/nokogiri/branch/main)
+
+[![Gem Version](https://badge.fury.io/rb/nokogiri.svg)](https://rubygems.org/gems/nokogiri)
+[![SemVer compatibility](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=nokogiri&package-manager=bundler&previous-version=1.11.7&new-version=1.12.5)](https://docs.github.com/en/code-security/supply-chain-security/managing-vulnerabilities-in-your-projects-dependencies/about-dependabot-security-updates#about-compatibility-scores)
+
+[![CII Best Practices](https://bestpractices.coreinfrastructure.org/projects/5344/badge)](https://bestpractices.coreinfrastructure.org/projects/5344)
+[![Tidelift dependencies](https://tidelift.com/badges/package/rubygems/nokogiri)](https://tidelift.com/subscription/pkg/rubygems-nokogiri?utm_source=rubygems-nokogiri&utm_medium=referral&utm_campaign=readme)
+
+
+## Support, Getting Help, and Reporting Issues
+
+All official documentation is posted at https://nokogiri.org (the source for which is at https://github.com/sparklemotion/nokogiri.org/, and we welcome contributions).
+
+### Reading
+
+Your first stops for learning more about Nokogiri should be:
+
+- [API Documentation](https://nokogiri.org/rdoc/index.html)
+- [Tutorials](https://nokogiri.org/tutorials/toc.html)
+- An excellent community-maintained [Cheat Sheet](https://github.com/sparklemotion/nokogiri/wiki/Cheat-sheet)
+
+
+### Ask For Help
+
+There are a few ways to ask exploratory questions:
 
-Nokogiri (鋸) is an HTML, XML, SAX, and Reader parser.  Among
-Nokogiri's many features is the ability to search documents via XPath
-or CSS3 selectors.
+- The Nokogiri mailing list is active at https://groups.google.com/group/nokogiri-talk
+- Open an issue using the "Help Request" template at https://github.com/sparklemotion/nokogiri/issues
 
-## Links
+Please do not mail the maintainers at their personal addresses.
 
-* http://nokogiri.org
-* [Installation Help](http://nokogiri.org/tutorials/installing_nokogiri.html)
-* [Tutorials](http://nokogiri.org)
-* [GitHub](https://github.com/sparklemotion/nokogiri)
-* [Mailing List](https://groups.google.com/group/nokogiri-talk)
-* [Bug Reports](https://github.com/sparklemotion/nokogiri/issues)
-* [Chat/Gitter](https://gitter.im/sparklemotion/nokogiri)
 
-[![Concourse CI](https://ci.nokogiri.org/api/v1/teams/nokogiri-core/pipelines/nokogiri/jobs/ruby-2.4-system/badge)](https://ci.nokogiri.org/teams/nokogiri-core/pipelines/nokogiri?groups=master)
-[![Code Climate](https://codeclimate.com/github/sparklemotion/nokogiri.svg)](https://codeclimate.com/github/sparklemotion/nokogiri)
-[![Join the chat at https://gitter.im/sparklemotion/nokogiri](https://badges.gitter.im/sparklemotion/nokogiri.svg)](https://gitter.im/sparklemotion/nokogiri?utm_source=badge&utm_medium=badge&utm_campaign=pr-badge&utm_content=badge)
+### Report A Bug
 
+The Nokogiri bug tracker is at https://github.com/sparklemotion/nokogiri/issues
 
-## Features
+Please use the "Bug Report" or "Installation Difficulties" templates.
 
-* XML/HTML DOM parser which handles broken HTML
-* XML/HTML SAX parser
-* XML/HTML Push parser
-* XPath 1.0 support for document searching
-* CSS3 selector support for document searching
-* XML/HTML builder
-* XSLT transformer
 
-Nokogiri parses and searches XML/HTML using native libraries (either C
-or Java, depending on your Ruby), which means it's fast and
-standards-compliant.
+### Security and Vulnerability Reporting
+
+Please report vulnerabilities at https://hackerone.com/nokogiri
+
+Full information and description of our security policy is in [`SECURITY.md`](SECURITY.md)
+
+
+### Semantic Versioning Policy
+
+Nokogiri follows [Semantic Versioning](https://semver.org/) (since 2017 or so). [![Dependabot's SemVer compatibility score for Nokogiri](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=nokogiri&package-manager=bundler&previous-version=1.11.7&new-version=1.12.5)](https://docs.github.com/en/code-security/supply-chain-security/managing-vulnerabilities-in-your-projects-dependencies/about-dependabot-security-updates#about-compatibility-scores)
+
+We bump `Major.Minor.Patch` versions following this guidance:
+
+`Major`: (we've never done this)
+
+- Significant backwards-incompatible changes to the public API that would require rewriting existing application code.
+- Some examples of backwards-incompatible changes we might someday consider for a Major release are at [`ROADMAP.md`](ROADMAP.md).
+
+`Minor`:
+
+- Features and bugfixes.
+- Updating packaged libraries for non-security-related reasons.
+- Dropping support for EOLed Ruby versions. [Some folks find this objectionable](https://github.com/sparklemotion/nokogiri/issues/1568), but [SemVer says this is OK if the public API hasn't changed](https://semver.org/#what-should-i-do-if-i-update-my-own-dependencies-without-changing-the-public-api).
+- Backwards-incompatible changes to internal or private methods and constants. These are detailed in the "Changes" section of each changelog entry.
+
+`Patch`:
+
+- Bugfixes.
+- Security updates.
+- Updating packaged libraries for security-related reasons.
+
+
+### Sponsorship
+
+You can help sponsor the maintainers of this software through one of these organizations:
+
+- [github.com/sponsors/flavorjones](https://github.com/sponsors/flavorjones)
+- [opencollective.com/nokogiri](https://opencollective.com/nokogiri)
+- [tidelift.com/subscription/pkg/rubygems-nokogiri](https://tidelift.com/subscription/pkg/rubygems-nokogiri?utm_source=rubygems-nokogiri&utm_medium=referral&utm_campaign=readme)
 
 
 ## Installation
 
-If this doesn't work:
+Requirements:
 
-```
-gem install nokogiri
-```
+- Ruby >= 2.7
+- JRuby >= 9.4.0.0
 
-then please start troubleshooting here:
 
-> http://www.nokogiri.org/tutorials/installing_nokogiri.html
+### Native Gems: Faster, more reliable installation
 
-There are currently 1,237 Stack Overflow questions about Nokogiri
-installation. The vast majority of them are out of date and therefore
-incorrect. __Please do not use Stack Overflow.__
+"Native gems" contain pre-compiled libraries for a specific machine architecture. On supported platforms, this removes the need for compiling the C extension and the packaged libraries, or for system dependencies to exist. This results in **much faster installation** and **more reliable installation**, which as you probably know are the biggest headaches for Nokogiri users.
 
-Instead, [tell us](http://nokogiri.org/tutorials/getting_help.html)
-when the above instructions don't work for you. This allows us to both
-help you directly and improve the documentation.
+### Supported Platforms
 
+Nokogiri ships pre-compiled, "native" gems for the following platforms:
 
-### Binary packages
+- Linux:
+  - `x86-linux` and `x86_64-linux` (req: `glibc >= 2.17`)
+  - `aarch64-linux` and `arm-linux` (req: `glibc >= 2.29`)
+  - Note that musl platforms like Alpine **are** supported
+- Darwin/MacOS: `x86_64-darwin` and `arm64-darwin`
+- Windows: `x86-mingw32`, `x64-mingw32`, and `x64-mingw-ucrt`
+- Java: any platform running JRuby 9.4 or higher
 
-Binary packages are available for some distributions.
+To determine whether your system supports one of these gems, look at the output of `bundle platform` or `ruby -e 'puts Gem::Platform.local.to_s'`.
 
-* Debian: https://packages.debian.org/sid/ruby-nokogiri
-* SuSE: https://download.opensuse.org/repositories/devel:/languages:/ruby:/extensions/
-* Fedora: http://s390.koji.fedoraproject.org/koji/packageinfo?packageID=6756
+If you're on a supported platform, either `gem install` or `bundle install` should install a native gem without any additional action on your part. This installation should only take a few seconds, and your output should look something like:
 
+``` sh
+$ gem install nokogiri
+Fetching nokogiri-1.11.0-x86_64-linux.gem
+Successfully installed nokogiri-1.11.0-x86_64-linux
+1 gem installed
+```
 
-## Support
 
-There are open-source tutorials (to which we invite contributions!) here: http://nokogiri.org/tutorials
+### Other Installation Options
 
-* The Nokogiri mailing list is active: https://groups.google.com/group/nokogiri-talk
-* The Nokogiri bug tracker is here: https://github.com/sparklemotion/nokogiri/issues
-* Before filing a bug report, please read our submission guidelines: http://nokogiri.org/tutorials/getting_help.html
-* The IRC channel is #nokogiri on freenode.
+Because Nokogiri is a C extension, it requires that you have a C compiler toolchain, Ruby development header files, and some system dependencies installed.
 
+The following may work for you if you have an appropriately-configured system:
+
+``` bash
+gem install nokogiri
+```
+
+If you have any issues, please visit [Installing Nokogiri](https://nokogiri.org/tutorials/installing_nokogiri.html) for more complete instructions and troubleshooting.
 
-## Security and Vulnerability Reporting
 
-See [`SECURITY.md`](SECURITY.md)
+## How To Use Nokogiri
 
+Nokogiri is a large library, and so it's challenging to briefly summarize it. We've tried to provide long, real-world examples at [Tutorials](https://nokogiri.org/tutorials/toc.html).
 
-## Synopsis
+### Parsing and Querying
 
-Nokogiri is a large library, but here is example usage for parsing and examining a document:
+Here is example usage for parsing and querying a document:
 
 ```ruby
 #! /usr/bin/env ruby
@@ -92,51 +171,26 @@ require 'nokogiri'
 require 'open-uri'
 
 # Fetch and parse HTML document
-doc = Nokogiri::HTML(open('http://www.nokogiri.org/tutorials/installing_nokogiri.html'))
+doc = Nokogiri::HTML(URI.open('https://nokogiri.org/tutorials/installing_nokogiri.html'))
 
-puts "### Search for nodes by css"
+# Search for nodes by css
 doc.css('nav ul.menu li a', 'article h2').each do |link|
   puts link.content
 end
 
-puts "### Search for nodes by xpath"
+# Search for nodes by xpath
 doc.xpath('//nav//ul//li/a', '//article//h2').each do |link|
   puts link.content
 end
 
-puts "### Or mix and match."
+# Or mix and match
 doc.search('nav ul.menu li a', '//article//h2').each do |link|
   puts link.content
 end
 ```
 
 
-## Requirements
-
-* Ruby 2.1.0 or higher, including any development packages necessary
-  to compile native extensions.
-
-* In Nokogiri 1.6.0 and later libxml2 and libxslt are bundled with the
-  gem, but if you want to use the system versions:
-
-  * First, check out [the long list](http://www.xmlsoft.org/news.html)
-    of fixes and changes between releases before deciding to use any
-    version older than is bundled with Nokogiri.
-
-  * At install time, set the environment variable
-    `NOKOGIRI_USE_SYSTEM_LIBRARIES` or else use the
-    `--use-system-libraries` argument. (See
-    http://nokogiri.org/tutorials/installing_nokogiri.html#using_your_system_libraries
-    for specifics.)
-
-  * libxml2 >=2.6.21 with iconv support
-    (libxml2-dev/-devel is also required)
-
-  * libxslt, built with and supported by the given libxml2
-    (libxslt-dev/-devel is also required)
-
-
-## Encoding
+### Encoding
 
 Strings are always stored as UTF-8 internally.  Methods that return
 text values will always return UTF-8 encoded strings.  Methods that
@@ -161,13 +215,73 @@ explicitly setting the encoding to EUC-JP on the parser:
   doc = Nokogiri.XML('<foo><bar /></foo>', nil, 'EUC-JP')
 ```
 
-## Development
 
-```bash
-  bundle install
-  bundle exec rake
-```
+## Technical Overview
+
+### Guiding Principles
+
+As noted above, two guiding principles of the software are:
+
+- be secure-by-default by treating all documents as **untrusted** by default
+- be a **thin-as-reasonable layer** on top of the underlying parsers, and don't attempt to fix behavioral differences between the parsers
+
+Notably, despite all parsers being standards-compliant, there are behavioral inconsistencies between the parsers used in the CRuby and JRuby implementations, and Nokogiri does not and should not attempt to remove these inconsistencies. Instead, we surface these differences in the test suite when they are important/semantic; or we intentionally write tests to depend only on the important/semantic bits (omitting whitespace from regex matchers on results, for example).
+
+
+### CRuby
+
+The Ruby (a.k.a., CRuby, MRI, YARV) implementation is a C extension that depends on libxml2 and libxslt (which in turn depend on zlib and possibly libiconv).
+
+These dependencies are met by default by Nokogiri's packaged versions of the libxml2 and libxslt source code, but a configuration option `--use-system-libraries` is provided to allow specification of alternative library locations. See [Installing Nokogiri](https://nokogiri.org/tutorials/installing_nokogiri.html) for full documentation.
+
+We provide native gems by pre-compiling libxml2 and libxslt (and potentially zlib and libiconv) and packaging them into the gem file. In this case, no compilation is necessary at installation time, which leads to faster and more reliable installation.
+
+See [`LICENSE-DEPENDENCIES.md`](LICENSE-DEPENDENCIES.md) for more information on which dependencies are provided in which native and source gems.
+
+
+### JRuby
+
+The Java (a.k.a. JRuby) implementation is a Java extension that depends primarily on Xerces and NekoHTML for parsing, though additional dependencies are on `isorelax`, `nekodtd`, `jing`, `serializer`, `xalan-j`, and `xml-apis`.
+
+These dependencies are provided by pre-compiled jar files packaged in the `java` platform gem.
+
+See [`LICENSE-DEPENDENCIES.md`](LICENSE-DEPENDENCIES.md) for more information on which dependencies are provided in which native and source gems.
+
+
+## Contributing
+
+See [`CONTRIBUTING.md`](CONTRIBUTING.md) for an intro guide to developing Nokogiri.
+
+
+## Code of Conduct
+
+We've adopted the Contributor Covenant code of conduct, which you can read in full in [`CODE_OF_CONDUCT.md`](CODE_OF_CONDUCT.md).
+
 
 ## License
 
-MIT. See [`LICENSE.md`](LICENSE.md).
+This project is licensed under the terms of the MIT license.
+
+See this license at [`LICENSE.md`](LICENSE.md).
+
+
+### Dependencies
+
+Some additional libraries may be distributed with your version of Nokogiri. Please see [`LICENSE-DEPENDENCIES.md`](LICENSE-DEPENDENCIES.md) for a discussion of the variations as well as the licenses thereof.
+
+
+## Authors
+
+- Mike Dalessio
+- Aaron Patterson
+- Yoko Harada
+- Akinori MUSHA
+- John Shahid
+- Karol Bucek
+- Sam Ruby
+- Craig Barnes
+- Stephen Checkoway
+- Lars Kanis
+- Sergio Arbeo
+- Timothy Elliott
+- Nobuyoshi Nakada

data/bin/nokogiri

@@ -1,61 +1,77 @@
 #!/usr/bin/env ruby
-require 'optparse'
-require 'open-uri'
-require 'uri'
-require 'rubygems'
-require 'nokogiri'
-autoload :IRB, 'irb'
+# frozen_string_literal: true
+
+require "optparse"
+require "open-uri"
+require "uri"
+require "rubygems"
+require "nokogiri"
+autoload :IRB, "irb"
 
 parse_class = Nokogiri
 encoding = nil
 
 # This module provides some tunables with the nokogiri CLI for use in
 # your ~/.nokogirirc.
-module Nokogiri::CLI
-  class << self
-    # Specify the console engine, defaulted to IRB.
-    #
-    # call-seq:
-    #   require 'pry'
-    #   Nokogiri::CLI.console = Pry
-    attr_writer :console
-
-    def console
-      case @console
-      when Symbol
-        Kernel.const_get(@console)
-      else
-        @console
+module Nokogiri
+  module CLI
+    class << self
+      # Specify the console engine, defaulted to IRB.
+      #
+      # call-seq:
+      #   require 'pry'
+      #   Nokogiri::CLI.console = Pry
+      attr_writer :console
+
+      def console
+        case @console
+        when Symbol
+          Kernel.const_get(@console)
+        else
+          @console
+        end
       end
+
+      attr_accessor :rcfile
     end
 
-    attr_accessor :rcfile
+    self.rcfile  = File.expand_path("~/.nokogirirc")
+    self.console = :IRB
   end
+end
 
-  self.rcfile  = File.expand_path('~/.nokogirirc')
-  self.console = :IRB
+def safe_read(uri_or_path)
+  uri = URI.parse(uri_or_path)
+  case uri
+  when URI::HTTP
+    uri.read
+  when URI::File
+    File.read(uri.path)
+  else
+    File.read(uri_or_path)
+  end
 end
 
 opts = OptionParser.new do |opts|
   opts.banner = "Nokogiri: an HTML, XML, SAX, and Reader parser"
-  opts.define_head "Usage: nokogiri <uri|path> [options]"
-  opts.separator ""
-  opts.separator "Examples:"
-  opts.separator "  nokogiri https://www.ruby-lang.org/"
-  opts.separator "  nokogiri ./public/index.html"
-  opts.separator "  curl -s http://www.nokogiri.org | nokogiri -e'p $_.css(\"h1\").length'"
-  opts.separator ""
-  opts.separator "Options:"
+  opts.define_head("Usage: nokogiri <uri|path> [options]")
+  opts.separator("")
+  opts.separator("Examples:")
+  opts.separator("  nokogiri https://www.ruby-lang.org/")
+  opts.separator("  nokogiri ./public/index.html")
+  opts.separator("  curl -s http://www.nokogiri.org | nokogiri -e'p $_.css(\"h1\").length'")
+  opts.separator("")
+  opts.separator("Options:")
 
   opts.on("--type type", "Parse as type: xml or html (default: auto)", [:xml, :html]) do |v|
-    parse_class = {:xml => Nokogiri::XML, :html => Nokogiri::HTML}[v]
+    parse_class = { xml: Nokogiri::XML, html: Nokogiri::HTML }[v]
   end
 
   opts.on("-C file", "Specifies initialization file to load (default #{Nokogiri::CLI.rcfile})") do |v|
     Nokogiri::CLI.rcfile = v
   end
 
-  opts.on("-E", "--encoding encoding", "Read as encoding (default: #{encoding || 'none'})") do |v|
+  opts.on("-E", "--encoding encoding", "Read as encoding (default: #{encoding || "none"})") do |v|
     encoding = v
   end
 
@@ -64,7 +80,7 @@ opts = OptionParser.new do |opts|
   end
 
   opts.on("--rng <uri|path>", "Validate using this rng file.") do |v|
-    @rng = open(v) {|f| Nokogiri::XML::RelaxNG(f)}
+    @rng = Nokogiri::XML::RelaxNG(safe_read(v))
   end
 
   opts.on_tail("-?", "--help", "Show this message") do
@@ -90,15 +106,10 @@ if File.file?(Nokogiri::CLI.rcfile)
   load Nokogiri::CLI.rcfile
 end
 
-if url || $stdin.tty?
-  case uri = (URI(url) rescue url)
-  when URI::HTTP
-    @doc = parse_class.parse(uri.read, url, encoding)
-  else
-    @doc = parse_class.parse(open(url).read, nil, encoding)
-  end
+@doc = if url || $stdin.tty?
+  parse_class.parse(safe_read(url), url, encoding)
 else
-  @doc = parse_class.parse($stdin, nil, encoding)
+  parse_class.parse($stdin, nil, encoding)
 end
 
 $_ = @doc
@@ -107,12 +118,14 @@ if @rng
   @rng.validate(@doc).each do |error|
     puts error.message
   end
-else
-  if @script
-    eval @script, binding, '<main>'
-  else
-    puts "Your document is stored in @doc..."
-    Nokogiri::CLI.console.start
+elsif @script
+  begin
+    eval(@script, binding, "<main>") # rubocop:disable Security/Eval
+  rescue Exception => e # rubocop:disable Lint/RescueException
+    warn("ERROR: Exception raised while evaluating '#{@script}'")
+    raise e
   end
+else
+  puts "Your document is stored in @doc..."
+  Nokogiri::CLI.console.start
 end
-

data/dependencies.yml

@@ -1,69 +1,41 @@
 libxml2:
-  version: "2.9.8"
-  sha256: "0b74e51595654f958148759cfef0993114ddccccbb6f31aee018f3558e8e2732"
-  # manually verified checksum:
-  #
-  #   $ gpg --verify libxml2-2.9.8.tar.gz.asc ./ports/archives/libxml2-2.9.8.tar.gz
-  #   gpg: Signature made Mon 05 Mar 2018 11:07:45 AM EST using RSA key ID 596BEA5D
-  #   gpg: Good signature from "Daniel Veillard (Red Hat work email) <veillard@redhat.com>"
-  #   gpg:                 aka "Daniel Veillard <Daniel.Veillard@w3.org>"
-  #   gpg: WARNING: This key is not certified with a trusted signature!
-  #   gpg:          There is no indication that the signature belongs to the owner.
-  #   Primary key fingerprint: C744 15BA 7C9C 7F78 F02E  1DC3 4606 B8A5 DE95 BC1F
-  #        Subkey fingerprint: DB46 681B B91A DCEA 170F  A2D4 1558 8B26 596B EA5D
-  #
-  # using this pgp signature:
-  #   -----BEGIN PGP SIGNATURE-----
-  #
-  #   iQEcBAABAgAGBQJanWtRAAoJEBVYiyZZa+pdV7oIAJWdFahwt+reN/Zt2RPmjjcr
-  #   eSsY7UV1RXjScnNjTzJT1h2hJ7SnUjCkqjR6VdtKDUIzpuX+S2U83joafJH6mxUb
-  #   yw2nO4RfjYTPxpz5JkvqT7jmgEIaD81BuwcMehqpMpIfiKa2NgO1DSfZxgs8a9E2
-  #   +ehc/kZWuI5gmNGrd84EEWUqpYW/Xx7jy02osioJuU5IMPjzZKNR3maXp9oAKeBc
-  #   S2QNa1ID/pUk3K3M/5nlwNgAtQ7lxQrqhrSma2dsKt/IpL6VXomxuD4Bh1r2MZhX
-  #   uZ456X/xJN8UmPewLZWGBU1MK9wqu3Zx5Qwz64H6UdlYIzXZ2jXj2YWZa6xkxPA=
-  #   =69xn
-  #   -----END PGP SIGNATURE-----
-  #
+  version: "2.11.4"
+  sha256: "737e1d7f8ab3f139729ca13a2494fd17bf30ddb4b7a427cf336252cab57f57f7"
+  # sha-256 hash provided in https://download.gnome.org/sources/libxml2/2.11/libxml2-2.11.4.sha256sum
 
 libxslt:
-  version: "1.1.32"
-  sha256: "526ecd0abaf4a7789041622c3950c0e7f2c4c8835471515fd77eec684a355460"
-  # manually verified checksum:
-  #
-  #   $ gpg --verify libxslt-1.1.32.tar.gz.asc libxslt-1.1.32.tar.gz
-  #   gpg: Signature made Thu 02 Nov 2017 04:35:04 PM EDT using RSA key ID 596BEA5D
-  #   gpg: Good signature from "Daniel Veillard (Red Hat work email) <veillard@redhat.com>"
-  #   gpg:                 aka "Daniel Veillard <Daniel.Veillard@w3.org>"
-  #   gpg: WARNING: This key is not certified with a trusted signature!
-  #   gpg:          There is no indication that the signature belongs to the owner.
-  #   Primary key fingerprint: C744 15BA 7C9C 7F78 F02E  1DC3 4606 B8A5 DE95 BC1F
-  #        Subkey fingerprint: DB46 681B B91A DCEA 170F  A2D4 1558 8B26 596B EA5D
-  #
-  # using this pgp signature:
-  #
-  #   -----BEGIN PGP SIGNATURE-----
-  #
-  #   iQEcBAABAgAGBQJZ+4F4AAoJEBVYiyZZa+pdy1IIAMX1DpzYGdnv6GCPSKeZ0woD
-  #   sHmSkygJep0/sUQD1cYunNsNZnGDgWhnsLAvHOn3opJgsiaZhmhJ8Uo7QNlT+ni1
-  #   AvRFgQoSXLWSF5kkun4u7RvnpDI6jYfCuYSwb9SO4EAYFAQQJXQaKCeFq71gad+p
-  #   XGHJFAy2TqUVLNZ5I1mQz/oBeDsJ7RzHpYqaBxsLDqrCzRQ9ai23q+dFGS3jvLBr
-  #   0gXw0MK73ceOwW12L5aLj4erNbATWmMFMDYZZwftysv3bgx2YfiOoZUTzufrB/Bc
-  #   MG8hP76aYBwIKNbhiDFGa2qdHGZGF7YQ4mi1/ZDX1K1G2tKKeEYxscM13JwiGb8=
-  #   =NuQO
-  #   -----END PGP SIGNATURE-----
-  #
+  version: "1.1.38"
+  sha256: "1f32450425819a09acaff2ab7a5a7f8a2ec7956e505d7beeb45e843d0e1ecab1"
+  # sha-256 hash provided in https://download.gnome.org/sources/libxslt/1.1/libxslt-1.1.38.sha256sum
 
 zlib:
-  version: "1.2.11"
-  sha256: "c3e5e9fdd5004dcb542feda5ee4f0ff0744628baf8ed2dd5d66f8ca1197cb1a1"
+  version: "1.2.13"
+  sha256: "b3a24de97a8fdbc835b9833169501030b8977031bcb54b3b3ac13740f846ab30"
   # SHA-256 hash provided on http://zlib.net/
 
 libiconv:
-  version: "1.15"
-  sha256: "ccf536620a45458d26ba83887a983b96827001e92a13847b45e4925cc8913178"
-  # gpg: Signature made Fri Feb  3 00:38:12 2017 CET
-  # gpg:                using RSA key 4F494A942E4616C2
-  # gpg: Good signature from "Bruno Haible (Open Source Development) <bruno@clisp.org>" [unknown]
-  # gpg: WARNING: This key is not certified with a trusted signature!
-  # gpg:          There is no indication that the signature belongs to the owner.
-  # Primary key fingerprint: 68D9 4D8A AEEA D48A E7DC  5B90 4F49 4A94 2E46 16C2
+  version: "1.17"
+  sha256: "8f74213b56238c85a50a5329f77e06198771e70dd9a739779f4c02f65d971313"
+  # signature verified by following this path:
+  # - release announced at https://savannah.gnu.org/forum/forum.php?forum_id=10175
+  # - which links to https://savannah.gnu.org/users/haible as the releaser
+  # - which links to https://savannah.gnu.org/people/viewgpg.php?user_id=1871 as the gpg key
+  #
+  # So:
+  # - wget -q -O - https://savannah.gnu.org/people/viewgpg.php?user_id=1871 | gpg --import
+  #     gpg: key F5BE8B267C6A406D: 1 signature not checked due to a missing key
+  #     gpg: key F5BE8B267C6A406D: public key "Bruno Haible (Open Source Development) <bruno@clisp.org>" imported
+  #     gpg: Total number processed: 1
+  #     gpg:               imported: 1
+  #     gpg: marginals needed: 3  completes needed: 1  trust model: pgp
+  #     gpg: depth: 0  valid:   4  signed:   0  trust: 0-, 0q, 0n, 0m, 0f, 4u
+  #     gpg: next trustdb check due at 2024-05-09
+  # - gpg --verify libiconv-1.17.tar.gz.sig ports/archives/libiconv-1.17.tar.gz
+  #     gpg: Signature made Sun 15 May 2022 11:26:42 AM EDT
+  #     gpg:                using RSA key 9001B85AF9E1B83DF1BDA942F5BE8B267C6A406D
+  #     gpg: Good signature from "Bruno Haible (Open Source Development) <bruno@clisp.org>" [unknown]
+  #     gpg: WARNING: This key is not certified with a trusted signature!
+  #     gpg:          There is no indication that the signature belongs to the owner.
+  #     Primary key fingerprint: 9001 B85A F9E1 B83D F1BD  A942 F5BE 8B26 7C6A 406D
+  #
+  # And this sha256sum is calculated from that verified tarball.