9cc7ffcf3b
gates / gates (push) Failing after 44s
MEASURED FIRST (audits/app-page-2026-10-15b/P0/VERDICT.md). The tab bar rendered unstyled through
the public address for one reason, and it was not the box: exactly one guest runs 0.315.0 and it
runs the registry's current digest (8887343011d6, identical to the registry's). The floor is still
0.314.0, so nothing else could have taken it.
What it was, in four measured facts:
1. the stylesheet URL is /static/style.css?v={{.Version}} -> ?v=0.315.0 for all THREE different
0.315.0 builds (e66d466, fe0228c, db52f5a), the first of which had no .app-tabs rules at all;
2. the origin sends NO validator at all (ETag present = 0, Last-Modified present = 0), so a
cached copy cannot be revalidated - it can only expire;
3. Cloudflare caches that URL (cf-cache-status HIT, age climbing) and rewrites the browser TTL
from the origin's 3600 to 14400 - four hours;
4. the session's first request returned cf-cache-status EXPIRED, which only happens when the edge
holds an entry that has aged out.
Origin, edge and box now agree byte-for-byte. The stale object itself is gone - that first probe
forced its revalidation - and the REPORT says so rather than claiming a HIT nobody can reproduce.
THE FIX IS IN TWO PARTS, NEITHER OF WHICH IS PURGING A CACHE:
build.sh refuses to push a version that already exists, before building, for --push and
--multiarch. A registry that cannot be asked is a refusal too: proving the tag is new is the point,
and "I could not ask" is not that proof. Local builds are untouched - reusing a version while
iterating is normal. scripts/test_build_push_once.sh drives the real build.sh with a fake docker on
PATH over six cases; red-proved twice (check deleted -> a present tag builds and pushes; an
unreachable registry treated as absent -> two cases fail).
assetTag() now hashes version + GitCommit + BuildTime, and EVERY shell's stylesheet link uses it
(seven of the nine asked for ?v={{.Version}}; only the two stranger-facing share pages already had
it). It stays opaque and 8 hex, because the share pages are reached by a capability URL and naming
the build to whoever holds one is a gift to somebody hunting a known fault. Cache-Control is
unchanged: the new address is the fix, not a shorter cache.
The parity harness normalises the asset tag on BOTH sides of the comparison, as it already does for
the per-session CSRF token, so all 148 fixtures stay byte-identical on disk and stop depending on
which build rendered them. The same normalisation is applied at the second comparison site in
i18n_wiring_test.go, which had the same assumption.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0117kRTSgs3rJWUFGxyoWN6Y
66 lines
4.0 KiB
HTML
66 lines
4.0 KiB
HTML
{{define "claim"}}
|
|
<!DOCTYPE html>
|
|
<html lang="{{T "layout.html_lang"}}">
|
|
<head>
|
|
<meta charset="UTF-8">
|
|
<meta name="viewport" content="width=device-width, initial-scale=1.0">
|
|
<title>{{if .IsReset}}{{T "claim.jelszo_visszaallitasa"}}{{else}}{{T "claim.a_szerver_beallitasa"}}{{end}} — Felhom</title>
|
|
<link rel="stylesheet" href="/static/style.css?v={{.AssetTag}}">
|
|
</head>
|
|
<body class="login-body">
|
|
<div class="login-card">
|
|
<img src="/static/felhom-logo.svg" alt="Felhom.eu" class="login-logo">
|
|
<h1 class="login-title">{{if .IsReset}}{{T "claim.jelszo"}} <span class="title-accent">{{T "claim.visszaallitasa"}}</span>{{else}}{{T "claim.a_szerver"}} <span class="title-accent">{{T "claim.beallitasa"}}</span>{{end}}</h1>
|
|
<p class="login-subtitle">{{.CustomerName}}</p>
|
|
|
|
{{if .Flash}}<div class="alert alert-info">{{.Flash}}</div>{{end}}
|
|
{{if .Error}}<div class="alert alert-error">{{.Error}}</div>{{end}}
|
|
|
|
{{/* R-295 — ONE NAME PER SECRET. This page used to call the SAME three-word code „Beállító
|
|
kód" on the first-time branch and „Visszaállító kód" on the reset branch, while the
|
|
TEN-word code that opens the sealed backups is called „Helyreállítási kód" elsewhere in
|
|
this UI. Two of those three names are near-homographs, and the collision cost a real code.
|
|
The ruling: the code that gives a person control of the DASHBOARD is „Beállító kód"
|
|
everywhere — the name this page already showed where it is typed — and where one secret
|
|
serves two situations the NAME stays constant and the SENTENCE changes. „Visszaállító
|
|
kód" is retired. This is naming only: no acceptance logic moved, and a test pins that a
|
|
reset code is still accepted here. */}}
|
|
{{if .HasCode}}
|
|
<p style="font-size:0.85rem;color:var(--text-muted,#8a94a6);margin:0 0 1rem">
|
|
{{if .IsReset}}{{T "claim.add_meg_az_e_mailben"}}{{else}}{{T "claim.add_meg_az_e_mailben_2"}}{{end}}
|
|
</p>
|
|
<form method="POST" action="/claim">
|
|
<input type="hidden" name="_csrf" value="{{.ClaimCSRF}}">
|
|
<div class="form-group">
|
|
<label for="code">{{T "claim.beallito_kod"}}</label>
|
|
<input type="text" id="code" name="code" required autofocus autocomplete="off"
|
|
placeholder="{{T "claim.szo_szo_szo"}}" class="form-control">
|
|
</div>
|
|
<div class="form-group">
|
|
<label for="new_password">{{T "claim.uj_jelszo_min_karakter"}}</label>
|
|
<input type="password" id="new_password" name="new_password" required minlength="{{.MinPassword}}"
|
|
placeholder="{{T "claim.legalabb_karakter"}}" class="form-control">
|
|
</div>
|
|
<div class="form-group">
|
|
<label for="confirm_password">{{T "claim.uj_jelszo_megerositese"}}</label>
|
|
<input type="password" id="confirm_password" name="confirm_password" required minlength="{{.MinPassword}}"
|
|
placeholder="{{T "claim.jelszo_megegyszer"}}" class="form-control">
|
|
</div>
|
|
<button type="submit" class="btn btn-primary btn-full">{{if .IsReset}}{{T "claim.jelszo_beallitasa"}}{{else}}{{T "claim.beallitas_es_belepes"}}{{end}}</button>
|
|
</form>
|
|
{{else}}
|
|
<div class="alert alert-info">{{T "claim.jelenleg_nincs_aktiv_kod_ehhez"}}</div>
|
|
{{end}}
|
|
|
|
<form method="POST" action="/claim/request-new-code" style="margin-top:1rem">
|
|
<input type="hidden" name="_csrf" value="{{.ClaimCSRF}}">
|
|
<button type="submit" class="btn btn-outline btn-full">{{if .IsReset}}{{T "claim.uj_beallito_kod_kerese"}}{{else}}{{T "claim.nem_kaptad_meg_a_kodot"}}{{end}}</button>
|
|
</form>
|
|
|
|
<p class="login-footer">{{T "claim.felhom_otthoni_szerver_kezeles_felhom"}}</p>
|
|
<div class="shell-lang">{{template "lang_globe" .}}</div>
|
|
</div>
|
|
</body>
|
|
</html>
|
|
{{end}}
|