broken patchwork site

broken patchwork site

[Mike Frysinger]

[-- Attachment #1: Type: text/plain, Size: 1889 bytes --]

i tried to find the overseers mailing list, but while the sourceware.org
site says things like "contact the overseers mailing list", i can't seem
to actually find that mailing list.

i also looked at bugzilla for an "infra" component but to no avail.

the http://patchwork.sourceware.org/ website doesn't fully load for me.
it misrenders and the javascript console is full of:

2016-02-19 01:45:14.368 patchwork.sourceware.org/:14 Refused to apply inline 
style because it violates the following Content Security Policy directive: 
"default-src 'self' http: https:". Either the 'unsafe-inline' keyword, a hash 
('sha256-nG1xoudMpbJeELjsW3kHtsm60dn6+RFwjddORJI/bh0='), or a nonce 
('nonce-...') is required to enable inline execution. Note also that 'style-src' 
was not explicitly set, so 'default-src' is used as a fallback.

2016-02-19 01:45:14.368 patchwork.sourceware.org/:27 Refused to apply inline 
style because it violates the following Content Security Policy directive: 
"default-src 'self' http: https:". Either the 'unsafe-inline' keyword, a hash 
('sha256-VWkG3rR92tqWKwxTi7FGCwo0s3+n19OMWDS2+QN0eiU='), or a nonce 
('nonce-...') is required to enable inline execution. Note also that 'style-src' 
was not explicitly set, so 'default-src' is used as a fallback.

2016-02-19 01:45:14.368 patchwork.sourceware.org/:39 Refused to apply inline 
style because it violates the following Content Security Policy directive: 
"default-src 'self' http: https:". Either the 'unsafe-inline' keyword, a hash 
('sha256-matwEc6givhWX0+jiSfM1+E5UMk8/UGLdl902bjFBmY='), or a nonce 
('nonce-...') is required to enable inline execution. Note also that 'style-src' 
was not explicitly set, so 'default-src' is used as a fallback.

i guess it's because https://patchwork.sourceware.org/ doesn't have a
proper cert ?  it presents a cygwin.com cert to me ...
-mike

[-- Attachment #2: Digital signature --]
[-- Type: application/pgp-signature, Size: 819 bytes --]

Re: broken patchwork site

[Andreas Schwab]

http://sourceware.org/ml/overseers/

Andreas.

-- 
Andreas Schwab, schwab@linux-m68k.org
GPG Key fingerprint = 58CA 54C7 6D53 942B 1756  01D3 44D5 214B 8276 4ED5
"And now for something completely different."

Re: broken patchwork site

[Mike Frysinger]

[-- Attachment #1: Type: text/plain, Size: 116 bytes --]

On 19 Feb 2016 09:28, Andreas Schwab wrote:
> http://sourceware.org/ml/overseers/

forwarded now ... thanks !
-mike

[-- Attachment #2: Digital signature --]
[-- Type: application/pgp-signature, Size: 819 bytes --]

Re: broken patchwork site

[Carlos O'Donell]

On 02/19/2016 01:46 AM, Mike Frysinger wrote:
> i tried to find the overseers mailing list, but while the sourceware.org
> site says things like "contact the overseers mailing list", i can't seem
> to actually find that mailing list.

I also saw this, and Siddhesh and I talked briefly about it,
but neither of us could fathom what was wrong.

Something has changed recently, but I don't remember exactly
when it stopped working properly. Just recently though, since
I haven't been looking at the page while working feverishly
on CVE-2015-7547.

Cheers,
Carlos.

Re: broken patchwork site

[Maciej W. Rozycki]

On Fri, 19 Feb 2016, Carlos O'Donell wrote:

> > i tried to find the overseers mailing list, but while the sourceware.org
> > site says things like "contact the overseers mailing list", i can't seem
> > to actually find that mailing list.
> 
> I also saw this, and Siddhesh and I talked briefly about it,
> but neither of us could fathom what was wrong.
> 
> Something has changed recently, but I don't remember exactly
> when it stopped working properly. Just recently though, since
> I haven't been looking at the page while working feverishly
> on CVE-2015-7547.

 Have you updated your web browser recently by any chance?  I've recently 
noticed the site does not render correctly under recent Firefox, but works 
just fine as it's used to with my old web browser.

 So I concluded it was browser breakage rather than a site problem and 
didn't even bother mentioning it anywhere, knowing what mess web browsers 
are, to say nothing of the fortnightly browser update pressure insanity.

 FWIW,

  Maciej

Re: broken patchwork site

[Frank Ch. Eigler]

"Carlos O'Donell" <carlos@redhat.com> writes:

>[...]
> I also saw this, and Siddhesh and I talked briefly about it,
> but neither of us could fathom what was wrong.

This was due to the recentish addition of Content-Security-Policy:
headers to many parts of the sourceware.org web site, in order to
better protect web apps from vulnerabilities like XSS.  It looks as
though patchwork is not compatible with that, so this protection was
just removed there.

- FChE

Re: broken patchwork site

[Carlos O'Donell]

On 02/19/2016 02:59 PM, Carlos O'Donell wrote:
> On 02/19/2016 01:46 AM, Mike Frysinger wrote:
>> i tried to find the overseers mailing list, but while the sourceware.org
>> site says things like "contact the overseers mailing list", i can't seem
>> to actually find that mailing list.
> 
> I also saw this, and Siddhesh and I talked briefly about it,
> but neither of us could fathom what was wrong.
> 
> Something has changed recently, but I don't remember exactly
> when it stopped working properly. Just recently though, since
> I haven't been looking at the page while working feverishly
> on CVE-2015-7547.

... and now it's fixed. How odd.

Cheers,
Carlos.

Re: broken patchwork site

[Carlos O'Donell]

On 02/19/2016 04:00 PM, Frank Ch. Eigler wrote:
> "Carlos O'Donell" <carlos@redhat.com> writes:
> 
>> [...]
>> I also saw this, and Siddhesh and I talked briefly about it,
>> but neither of us could fathom what was wrong.
> 
> This was due to the recentish addition of Content-Security-Policy:
> headers to many parts of the sourceware.org web site, in order to
> better protect web apps from vulnerabilities like XSS.  It looks as
> though patchwork is not compatible with that, so this protection was
> just removed there.

Thanks! That explains it.

c.