From dcd5bbe011f4ddd4dd7655c56b350c94d9424c85 Mon Sep 17 00:00:00 2001
From: Luca Milanesio <luca.milanesio@gmail.com>
Date: Mon, 19 Jun 2023 14:56:52 +0100
Subject: Introduce Documentation:searchfree_safe with local-only fonts

Gerrit documentation uses asciidoc webfonts [1] which can be flagged
as a security issue because of Content Security Policies [2].

[1] https://docs.asciidoctor.org/asciidoctor/latest/html-backend/default-stylesheet/#disable-or-modify-the-web-fonts
[2] https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP

Release-Notes: Allow generating safe local-only documentation
Change-Id: Ide4369ca19473822fc5305aa0fc21665a2bc6f0c
---
 Documentation/BUILD         | 10 ++++++++++
 Documentation/dev-bazel.txt | 13 +++++++++++++
 tools/bzl/asciidoc.bzl      |  3 ++-
 3 files changed, 25 insertions(+), 1 deletion(-)

diff --git a/Documentation/BUILD b/Documentation/BUILD
index af355ca56d..85ddbe7413 100644
--- a/Documentation/BUILD
+++ b/Documentation/BUILD
@@ -126,3 +126,13 @@ genasciidoc_zip(
     directory = DOC_DIR,
     searchbox = False,
 )
+
+genasciidoc_zip(
+    name = "searchfree_safe",
+    srcs = SRCS,
+    attributes = documentation_attributes(),
+    backend = "html5",
+    directory = DOC_DIR,
+    searchbox = False,
+    webfonts = False,
+)
diff --git a/Documentation/dev-bazel.txt b/Documentation/dev-bazel.txt
index 08529dfcba..a2bd6fca6e 100644
--- a/Documentation/dev-bazel.txt
+++ b/Documentation/dev-bazel.txt
@@ -225,6 +225,19 @@ The html files will be bundled into `searchfree.zip` in this location:
   bazel-bin/Documentation/searchfree.zip
 ----
 
+To use local fonts with the searchfree target:
+
+----
+  bazel build Documentation:searchfree_safe
+----
+
+The html files will be bundled into `searchfree.zip` or `searchfree_safe.zip` in this location:
+
+----
+  bazel-bin/Documentation/searchfree.zip
+  bazel-bin/Documentation/searchfree_safe.zip
+----
+
 To generate HTML files skipping the zip archiving:
 
 ----
diff --git a/tools/bzl/asciidoc.bzl b/tools/bzl/asciidoc.bzl
index 7977cf051d..d6b6d6320c 100644
--- a/tools/bzl/asciidoc.bzl
+++ b/tools/bzl/asciidoc.bzl
@@ -300,13 +300,14 @@ def genasciidoc_zip(
         backend = None,
         searchbox = True,
         resources = True,
+        webfonts = True,
         **kwargs):
     SUFFIX = "_htmlonly"
 
     _genasciidoc_htmlonly_zip(
         name = name + SUFFIX if resources else name,
         srcs = srcs,
-        attributes = attributes,
+        attributes = attributes + [] if webfonts else ["webfonts!"],
         backend = backend,
         searchbox = searchbox,
         **kwargs
-- 
cgit v1.2.3