Conversation
…nifest
`ARG VITE_MEDIA_URL=` defined the variable as an empty string, and Vite
distinguishes a variable that is absent from one that is defined and empty:
absent, the bundle keeps `const e={}, x=!!e?.VITE_MEDIA_URL`; defined and
empty, it folds to a constant and minification removes the branch.
So every deployment built from this image produced a bundle that did not
match the manifest `.github/workflows/release.yml` publishes — including a
deployment running no media server at all. That is backwards from what
`docs/THREAT-MODEL.md` § 4quinquies claims: the trade is "verifiable **or**
calls", and a deployment configuring no calls was paying it anyway. It made
the whole publishing mechanism inert in the one configuration it was built
for.
Reproduced here before committing, `dist/index.html`:
variable absent, as CI builds it 2a26c3f24aff3326
ARG VITE_MEDIA_URL= (before) 9b4c1178cc297802
unset when empty (after) 2a26c3f24aff3326
unset when empty, calls configured a13e1dcae6b3cbae
The last line is the one that must still differ, and does: a deployment that
configures calls names an origin in its policy and knowingly stops matching.
Mine to have missed. I measured that configuration no longer changes the
bytes, and then wrote a Dockerfile that reintroduced exactly that — because
the measurement was run without the variable while the image always set it.
Testing the thing rather than the thing as it is deployed.
…e image `.dockerignore` patterns match against paths relative to the context root unless they begin with `**/`. So `dist/` excluded the one at the top and copied `apps/web/dist` straight in, and `node_modules/` did the same with 683 MiB of `apps/web/node_modules`. The context carried 683 files where the source tree has 457. # What the stale dist did, which is the reason this is a fix and not a tidy-up Tailwind scans source files for class names. Given the previous bundle, it scanned that too and emitted a different stylesheet, so the chunk hashes moved and `index.html` with them. The deployment then no longer matched the manifest `.github/workflows/release.yml` publishes — which is precisely the property `scripts/verify-web.sh` exists to check. A build whose output depends on whether somebody ran `pnpm run build` beforehand is not reproducible, and nothing anywhere said so. It presented as five altered files out of 226, all of them the ones Vite produces. # Measured, before and after `scripts/verify-web.sh` against a `deploy/` stack, using the manifest from the v0.1.0 release: before 221 matched, 5 altered, 0 missing after 226 matched, 0 altered, 0 missing Context file count: 683 → 457, the same as the source tree.
…manifest fix(deploy): make a deployment match the manifest it publishes
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Carries the two deployment fixes from #47 to the branch people land on.
8163e70 fix(deploy): unset an empty media origin, so the image matches the manifest8b9b814 fix(docker): anchor the ignore patterns, or apps/web/dist ships in the imageWhy this matters now that the repository is public.
mainis the default branch, so somebody cloning today and standing updeploy/gets a bundle that does not match the manifest v0.1.0 publishes —scripts/verify-web.shreports221 matched, 5 altered. The mechanism the release exists for does not work from the branch a visitor gets.After:
226 matched, 0 altered, 0 missing.Two files, no source change, no migration. CI on #47:
changesandwebgreen;rust,wasmandauditskipped by their path filters, since neither file touches Rust, the WASM artefact orCargo.lock.