Clarify manual installation of PhotoSwipe files from Git and ZIP-file

The packages.json file is also required, since it is used as a verifier:

• https://git.drupalcode.org/issue/photoswipe-3610060/-/blob/5.x/photoswip...
• https://git.drupalcode.org/issue/photoswipe-3610060/-/blob/5.x/modules/p...

Adding suggestion for a simplified project page text, simply linking to instructions in the README, so we only have to update one place.

Thanks for weighing in @fkelly12054@gmail.com, but that's for another issue. This issue is only about getting the PhotoSwipe files placed correctly -- but feel free to create one :)

Ah yes, I forgot the MR ... sorry @anybody. Maybe some things have changed, as part of the migration to Gitlab? Because I created an MR (https://git.drupalcode.org/project/photoswipe/-/merge_requests/155) and it took a while before the "MR !155 mergeable" link appeared, it usually shows up right away ...

Adding suggestion to add Documentation link, and maybe also link to the PhotoSwipe page for a page with more examples?

Great, thanks for reviewing @anybody!

I thought it was easier to move the Git part over here, rather than having to juggle two README MR's, so closing the other issue.

Updating Issue Summary, remaining tasks are updating the project page, and adding Documentation link.

Thanks @anybody!

About the project page, a while ago I added a suggestion about that in the Issue Summary, could that work?
(I just now added check marks and empty boxes, to make it clearer what is done, and not.)

So, there are also suggestions for additional links under "Resources" :)

And then there is a last item, about a possible follow-up issue, switching from a check on packages.json, to the three CSS files.

Thanks @anybody, sounds good!

I am adding a few related issues about why it's better to only add the required files, since a vulnerability may slip in undetected, if you use Composer or Git to add a third-party library, as opposed to manually unzipping a ZIP-file, and cherry-picking only the needed file(s).

For example, all 175 Photoswipe library files are downloaded if you use the Composer methods, and are publicly accessible, like this one:

https://example.org/libraries/photoswipe/demo-docs-website/src/components/PswpCodePreview/gallery-templates/srcset-test.js

Using ZIP can be just as unsafe, if you do not clean up afterwards, and remove all unnecessary files.

Another example is the recent issue about HTML support in Captions (#3574103: Allow limited HTML in captions through domPurify, move caption README in main module and fix tests), where only a single JavaScript file is needed from DOMPurify, but the ZIP-file includes 112 files, and the Git repo includes 144 files (many of them are hidden):

Zip file

user:~$ unzip DOMPurify-main.zip
user:~$ tree -a DOMPurify-main
[...]
27 directories, 112 files

Git clone

user:~$ git clone https://github.com/cure53/DOMPurify
user:~$ tree -a DOMPurify
.
├── .babelrc
├── CODE_OF_CONDUCT.md
├── CODEOWNERS
├── config
│   ├── playwright.config.js
[...]
│   │   └── tsconfig.json
│   ├── package.json
│   └── verify.js
└── website
    └── index.html

44 directories, 140 files

Similarly for the external Photoswipe library, many unneeded extra files are publicly accessible, using the recommended Composer method:

$ composer require bower-asset/photoswipe:^5
./composer.json has been updated
Running composer update bower-asset/photoswipe
[...]

$ tree -a web/libraries/photoswipe/
web/libraries/photoswipe/
├── .babelrc
├── build
│   ├── config-builder.js
│   ├── rollup.config.js
│   └── rollup.config.watch.js
[...]
│   │       ├── spring-easer.js
│   │       ├── util.js
│   │       └── viewport-size.js
│   └── photoswipe.css
└── tsconfig.json

45 directories, 175 files

By the way, I see that there is an asset package for DOMPurify https://asset-packagist.org/package/npm-asset/dompurify
... and it seems to work:

$ composer require npm-asset/dompurify
./composer.json has been updated
Running composer update npm-asset/dompurify
[...]
Using version ^3.4 for npm-asset/dompurify

$ tree -L1 web/libraries/dompurify/
web/libraries/dompurify/
├── dist
├── LICENSE
├── LICENSE-MPL
├── package.json
├── README.md
└── src

$ ls web/libraries/dompurify/dist/purify.min.js
web/libraries/dompurify/dist/purify.min.js

Thank you @grevil, the new links to Documentation and demonstration are nice little improvements.

I updated the wording in the README MR in the process, but forgot to update the suggested README in the Issue Summary ... So there is no longer a "Manual installation", sorry about that.

I have updated the proposal with "Git", "Zip", and anchor links ... so perhaps this could work better?

And what do you both think about the follow up issue suggestion (#5) about changing the verification method, and check if the three CSS and JavaScript files are present, instead of packages.json? I can create it, if you want?

Thanks for looking at this @grevil.

But the only mention of "manual" is under "Photoswipe Dynamic Caption Submodule" ... isn't this confusing for the user, if they scan for "Manual Installation"?

Also, please note that I asked two questions :)