Tell to browsers the resources we will need, as soon as possible. This
means they do not need to fully download our CSS to know what they
should load next.
For some reason, crossorigin is required on fonts to avoid them being
loaded twice by Firefox.
Signed-off-by: Théo Lebrun <theo.lebrun@bootlin.com>
Avoid many tiny requests. The issue is that browsers have a limited
amount of concurrent requests they can make. We do 19 for
loading /linux/v6.11.6/source. Reduce that to 14.
Signed-off-by: Théo Lebrun <theo.lebrun@bootlin.com>
Previously, the web server was responsible for redirecting '/' to a
sensible URL. Most likely, the target URL was '/linux/latest/source'.
From there on, web did the redirect to the proper version.
Avoid a redirect by handling '/' directly from our application to the
correct version.
Signed-off-by: Théo Lebrun <theo.lebrun@bootlin.com>
Pygments 2.12.0 slightly changed the order of HTML elements which
makes line numbers look weird with current CSS styles.
Quoting changelog:
> When linenos=table is used, the <table> itself is now wrapped
> with a <div class="highlight"> tag instead of placing it
> inside the <td class="code"> cell (#632.) With this change,
> the output matches the documented behavior.
https://pygments.org/docs/changelog/#version-2-12-0
Related issue: https://github.com/pygments/pygments/issues/632
This commit aims to fix this by further restricting CSS selectors
that selected everything under .highlight to only select source code
related elements - descendants of .code in the new layout.
This was also tested on Pygemnts 2.14.0, version currently packaged
for Debian Bookworm
https://packages.debian.org/bookworm/armel/python3-pygments
* Run pytest only for t, do not run tests for other libraries
* Add email and name git options to test repo init
* Change test repo permissions to avoid "dubious ownership" error
Current update script serializes database access using mutexes.
According to a user of Oracle support forums, this is not enough.
https://forums.oracle.com/ords/apexds/post/berkeley-db-file-corrupted-while-operating-for-hours-panic-4953
> if you are accessing the same database from multiple threads or
> multiple processes, they must share a cache (memory pool). In other
> words, it is not sufficient to just make sure no DB->put or DB->get
> operations are run simultaneously as you do with mutexes. Berkeley
> DB also maintains information about database files across calls in
> the cache, such as the list of free pages. If two threads accessing
> a database file have independent freelists, they will eventually
> both try to allocate the same page for different purposes, and the
> structure of the file will be compromised.
DB.open provides a flag that should be specified if database is to be
shared between threads
https://docs.oracle.com/cd/E17276_01/html/api_reference/C/dbopen.html
> DB_THREAD
> Cause the DB handle returned by DB->open() to be free-threaded; that
> is, concurrently usable by multiple threads in the address space.
> You should use this flag only in the absence of an encompassing
> environment.
While this probably won't solve all database concurrency issues (web
accessing the database during updates likely still will behave weird)
it could help with recent database corruption issues.
https://docs.oracle.com/cd/E17276_01/html/programmer_reference/program_mt.html
> The DB_THREAD flag must be specified to the DB_ENV->open() and
> DB->open() methods if the Berkeley DB handles returned by those
> interfaces will be used in the context of more than one thread.
> Setting the DB_THREAD flag inconsistently may result in database
> corruption.
> When using the non-cursor Berkeley DB calls to retrieve key/data
> items (for example, DB->get()), the memory to which the pointer
> stored into the Dbt refers is valid only until the next call using
> the DB handle returned by DB->open(). This includes any use of the
> returned DB handle, including by another thread within the process.
>
> For this reason, if the DB_THREAD handle was specified to the
> DB->open() method, either DB_DBT_MALLOC, DB_DBT_REALLOC or
> DB_DBT_USERMEM must be specified in the DBT when performing any
> non-cursor key or data retrieval.
It seems that bsddb3 sets appropriate flags in DBTs for us if DB_THREAD
is specified.
https://hg.jcea.es/pybsddb/file/tip/src/Module/berkeleydb.c#l2025
(ctrl+f for DB_THREAD)
I believe DBTs used in DB_put shouldn't require any extra flags because
the DBTs are only read by Berkeley DB (doesn't matter if they get
invalidated on the next call).
Linux is the only currently supported project for which we want three
remote URLs; see index-all-repositories for the list.
We could optimise the fetching by doing a single fetch call to all
remotes at the same time using --jobs (or fetch.parallel config).
Signed-off-by: Théo Lebrun <theo.lebrun@bootlin.com>
Two issues are fixed:
- Initial `docker build` instructions fail because the Dockerfile path
is wrong (elixir/Dockerfile versus elixir/docker/Dockerfile).
- Indexing instructions are wrong because they do not use the
virtualenv Python. It contains the installed packages, which we need
for indexing. Issue appears as:
ModuleNotFoundError: No module named 'bsddb3' (edited)
We also remove some common Docker knowledge (why we might want the
database to be coming from a mounted volume, rather than stored inside
the container).
Finally, we fix line widths but splitting commands into multiple lines.
Signed-off-by: Théo Lebrun <theo.lebrun@bootlin.com>
We reword the TODO message. We put two newlines before and after the
triple dashes to avoid Markdown title formatting.
Signed-off-by: Théo Lebrun <theo.lebrun@bootlin.com>
Now making a GET to /project/version/ident will redirect to
/project/version/source.
Refreshing a page after making a request for an empty identifier won't
show 405 Method Not Allowed anymore.
This is NOT being served by Elixir backend. The HTTP server in front
must serve it. Commit robots.txt to store the file somewhere.
Signed-off-by: Théo Lebrun <theo.lebrun@bootlin.com>
For some reason, browsers do not automatically pick up the hosted
favicon.ico available on staging server. Add an explicit line to
describe the availability of /favicon.ico.
Signed-off-by: Théo Lebrun <theo.lebrun@bootlin.com>
favicon.ico being served is not dependent on Elixir's configuration, but
on the front-facing server. Its config must be updated to serve the
favicon; this is why favicon.ico used to not be commited into the
repo.
Signed-off-by: Théo Lebrun <theo.lebrun@bootlin.com>
Mark the searchbar as a required input. This avoids <Enter> on an empty
searchbar to send a "POST /$PROJECT/$VERSION/ident" with empty value,
which triggers an error.
This is made more frequent by the fact that the searchbar is
automatically focused. It also avoids implementing logic on the backend
to redirect to the previous page if an empty search was submitted.
Signed-off-by: Théo Lebrun <theo.lebrun@bootlin.com>
Fixes the following bug:
1. Make sure show-menu == true
2. Open page in mobile mode
3. Reisze to widescreen
Sidebar will be hidden until page is reloaded.
As usual, we must increment those version numbers when changes are made
to style.css and/or script.js. That purges the production cache.
Signed-off-by: Théo Lebrun <theo.lebrun@bootlin.com>
As usual, we must increment those version numbers when changes are made
to style.css and/or script.js. That purges the production cache.
Signed-off-by: Théo Lebrun <theo.lebrun@bootlin.com>
As usual, we must increment those version numbers when changes are made
to style.css and/or script.js. That purges the production cache.
Signed-off-by: Théo Lebrun <theo.lebrun@bootlin.com>
As usual, we must increment those version numbers when changes are made
to style.css and/or script.js. That purges the production cache.
Signed-off-by: Théo Lebrun <theo.lebrun@bootlin.com>
The local storage API returns strings and has no way to set a default
value in case no value exists. We must therefore check for the "true"
string or the null value.
Let's extract it from the if boolean expression. We go from:
if (isWidescreen && (showSidebar === "true" || showSidebar === null))
To:
if (isWidescreen && showSidebar)
Signed-off-by: Théo Lebrun <theo.lebrun@bootlin.com>
Backwards compatibility for browsers without svg support (in this
version) causes the logo to unnecessarily flicker on navigation.
According to caniuse.com SVG in img elements is supported in browsers
used by 97.85% of users. https://caniuse.com/svg-img
Firefox introduced support in 2011, Chrome in 2013, Safari in 2015.
This parameter makes the server return a response with raw file
contents and headers that cause the browser to show a 'save as' dialog.
Regarding Content-Security-Policy:
https://www.w3.org/TR/CSP2/#sandbox-usage
> For example, a message board or email system might provide downloads of
> arbitrary attachments provided by other users. Attacks that rely on tricking
> a client into rendering one of these attachments could be mitigated by
> requesting that resources only be rendered in a very restrictive sandbox.
> Sending the sandbox directive with an empty value establishes such an
> environment:
>
> Content-Security-Policy: sandbox
https://www.w3.org/TR/CSP2/#directive-default-src
> Given this behavior, one good way of building a policy for a site would be to
> begin with a default-src of 'none', and to build up a policy from there that
> contains only those resource types which are actually in use for the page
> you’d like to protect. If you don’t use webfonts, for instance, there’s no
> reason to specify a source list for font-src; specifying only those resource
> types a page uses ensures that the possible attack surface for that page
> remains as small as possible.
https://cheatsheetseries.owasp.org/cheatsheets/Content_Security_Policy_Cheat_Sheet.html#defense-in-depth
> A strong CSP provides an effective second layer of protection against various
> types of vulnerabilities, especially XSS. Although CSP doesn't prevent web
> applications from containing vulnerabilities, it can make those
> vulnerabilities significantly more difficult for an attacker to exploit.
The idea is to prevent the browser from loading any external resources, if it
turned out it's possible to trick it into interpreting a file as HTML.
