1/3 of release files are cache, exclusively for 'run' users

[jidanni]

I have:

• searched the issue tracker for similar issues
• installed the latest version of Quarto CLI
• formatted my issue following the Bug Reports guide

Bug description

$ dlocate -L quarto|grep -c  /cache/
1038
$ dlocate -L quarto|grep -cv /cache/
1969
$ quarto --version
1.9.37

Can you believe the .debs were 1/3 cache files all along. Right under everybody's noses. I've saved everybody many many megabytes with this report.

[jidanni]

I'd even clean up the old .debs too. Imagine,

$ dlocate -ls quarto |perl -anwle 'next if /^d/||!/cache/;
print $F[-1];'|xargs file --brief --mime|sort|uniq -c|sort -nr
    800 application/javascript; charset=us-ascii
    188 text/plain; charset=us-ascii
     23 application/javascript; charset=utf-8
      3 text/plain; charset=utf-8
      2 text/x-c++; charset=us-ascii
      2 application/vnd.sqlite3; charset=binary
      1 text/x-c++; charset=utf-8
      1 text/x-Algol68; charset=us-ascii
      1 application/json; charset=us-ascii
#We're talking 100% cleartext. No encryption.
#(because they were never intended to leave
#the developer's machine in the first place.)

#One file spots our eye:
$ dlocate ...|xargs file --brief
ASCII text, with very long lines (4532)
ASCII text, with very long lines (5232, PPI)
ASCII text, with very long lines (6723)
$ man ... | grep PPI
PPI - Plenty of Personal Information

$ perl -nwle 'next unless /source/; s![^,]+,!!; print;' file.js | base64 -d
# Gasp, it's photos of the lead developer's dog, Smuggums.

$ cp /opt/quarto/share/deno_std/cache/dep_analysis_cache_v2 /tmp
$ sqlite3 /tmp/dep_analysis_cache_v2 .dump
INSERT INTO moduleinfocache VALUES('https://jsr.io/@std/crypto/
0.224.0/_wasm/lib/deno_std_wasm_crypto.d.mts',10,smuggums88,'{}');
# Gasp II: dog's name used as master password for entire project.

[jidanni]

Yes, on first look just the .debs, but probably all of
https://github.com/quarto-dev/quarto-cli/releases
other versions also affected.

[cderv]

Thanks for the report.

I checked the deb on my end. The 1,039 entries under /opt/quarto/share/deno_std/cache/ are a pre-populated Deno standard library cache (a DENO_DIR) that Quarto bundles in every installer. Total size: ~9.5 MB uncompressed. It exists to support the quarto run command — which executes user-supplied TypeScript scripts — without requiring a network download on first use.

So while it's a third of the file count of the package, it's closer to ~6% of the unpacked size. It's not a personal cache or accidental leak — it's a deliberate design choice that's worked well for users on air-gapped or slow-network environments. We can discuss whether bundling vs. lazy-fetching on first quarto run is the right tradeoff today though. However, it works this way today.

Can you confirm those are the files you were referring to?

[jidanni]

I see.
This is the first time I have encountered such a design choice. Looked like someone left their trash on the table at the fast food diner. My apologies.

But boy is it a bad decision. Here I am, a simple "render" user, needing to get the larger parking space for the "run" users' needs, even though there is only one person on my computer. It's like no wonder there's a housing crisis when the smallest unit available is the four bedroom penthouse estate.

As a matter of fact

format:
  html:
    minimal: true

is me. So I bet only 1/10 of the .Deb is what I'm using. I'm also using emacs-nox, and was using libreoffice headless until switching to quarto to reduce bloat... alas...

P.S., do put a README in /opt/quarto/share/deno_std/cache/ explaining the situation.

[cscheid]

It is not our responsibility to ensure that you understand how this software works. It is your responsibility to be conscientious about the time burden you are imposing on the developers of this project. This is another code of conduct violation.

I've asked you once mildly, and now I will ask you sternly. Please change your behavior in this repository or I will remove your permissions to post here.