|
fb38d31…
|
drh
|
1 |
<title>How The Fossil Download Page Works</title> |
|
fb38d31…
|
drh
|
2 |
|
|
fb38d31…
|
drh
|
3 |
<h2>1.0 Overview</h2> |
|
fb38d31…
|
drh
|
4 |
|
|
fb38d31…
|
drh
|
5 |
The [/uv/download.html|Download] page for the Fossil self-hosting |
|
fb38d31…
|
drh
|
6 |
repository is implemented using [./unvers.wiki|unversioned files]. |
|
fb38d31…
|
drh
|
7 |
The "download.html" screen itself, and the various build products |
|
fb38d31…
|
drh
|
8 |
are all stored as unversioned content. The download.html page |
|
c64f28d…
|
drh
|
9 |
uses XMLHttpRequest() to retrieve the [/help/www/juvlist|/juvlist] webpage |
|
498cfbf…
|
drh
|
10 |
for a list of all unversioned files. Javascript in the |
|
498cfbf…
|
drh
|
11 |
[/uv/download.js?mimetype=text/plain|download.js] file (which is |
|
498cfbf…
|
drh
|
12 |
sourced by "download.html") then figures out which unversioned files are |
|
fb38d31…
|
drh
|
13 |
build products and paints appropriate icons on the displayed |
|
fb38d31…
|
drh
|
14 |
download page. |
|
fb38d31…
|
drh
|
15 |
|
|
8f4fd8c…
|
drh
|
16 |
Except, the "Source Tarball" download products are not stored as |
|
8f4fd8c…
|
drh
|
17 |
unversioned files. They are computed on-demand by the |
|
c64f28d…
|
drh
|
18 |
[/help/www/tarball|/tarball web page]. |
|
8f4fd8c…
|
drh
|
19 |
|
|
f2e9eeb…
|
drh
|
20 |
When a new version is generated, the developers use the |
|
c64f28d…
|
drh
|
21 |
[/help/uv|fossil uv edit] command to make minor changes |
|
498cfbf…
|
drh
|
22 |
to the "[/uv/download.js?mimetype=text/plain|download.js]" |
|
fb38d31…
|
drh
|
23 |
file so that it knows about the |
|
fb38d31…
|
drh
|
24 |
new version number. Then the developers run |
|
c64f28d…
|
drh
|
25 |
the [/help/uv|fossil uv add] command for each |
|
fb38d31…
|
drh
|
26 |
build product. Finally, the |
|
c64f28d…
|
drh
|
27 |
[/help/uv|fossil uv sync] command is run to push all |
|
7f4b50b…
|
jan.nijtmans
|
28 |
the content up to servers. All |
|
fb38d31…
|
drh
|
29 |
[./selfhost.wiki|three self-hosting repositories] for Fossil |
|
fb38d31…
|
drh
|
30 |
are updated automatically. |
|
fb38d31…
|
drh
|
31 |
|
|
fb38d31…
|
drh
|
32 |
<h2>2.0 Details</h2> |
|
fb38d31…
|
drh
|
33 |
|
|
498cfbf…
|
drh
|
34 |
The current text of the "download.html" and "download.js" files can |
|
498cfbf…
|
drh
|
35 |
be seen at: |
|
498cfbf…
|
drh
|
36 |
|
|
498cfbf…
|
drh
|
37 |
* [/uv/download.html?mimetype=text/plain] |
|
498cfbf…
|
drh
|
38 |
* [/uv/download.js?mimetype=text/plain] |
|
498cfbf…
|
drh
|
39 |
|
|
498cfbf…
|
drh
|
40 |
Notice how the hyperlinks above use the "mimetype=text/plain" |
|
498cfbf…
|
drh
|
41 |
query parameter in order to display the file as plain text |
|
498cfbf…
|
drh
|
42 |
instead of the usual HTML or Javascript. |
|
498cfbf…
|
drh
|
43 |
|
|
498cfbf…
|
drh
|
44 |
The default mimetype for "download.html" is |
|
fb38d31…
|
drh
|
45 |
text/html. But because the entire page is enclosed within |
|
fb38d31…
|
drh
|
46 |
|
|
fc2965b…
|
wyoung
|
47 |
<verbatim><div class='fossil-doc' data-title='Download Page'>...</div></verbatim> |
|
fb38d31…
|
drh
|
48 |
|
|
fb38d31…
|
drh
|
49 |
Fossil knows to add its standard header and footer information to the |
|
fb38d31…
|
drh
|
50 |
document, making it look just like any other page. See |
|
fb38d31…
|
drh
|
51 |
"[./embeddeddoc.wiki|embedded documentation]" for further details on |
|
f5d1c5e…
|
drh
|
52 |
how this <div class='fossil-doc'> markup works. |
|
fb38d31…
|
drh
|
53 |
|
|
fb38d31…
|
drh
|
54 |
With each new release, the "releases" variable in the javascript on |
|
498cfbf…
|
drh
|
55 |
the [/uv/download.js?mimetype=text/plain|download.js] page is |
|
c64f28d…
|
drh
|
56 |
edited (using "[/help/uv|fossil uv edit download.js]") to add |
|
fb38d31…
|
drh
|
57 |
details of the release. |
|
fb38d31…
|
drh
|
58 |
|
|
0996347…
|
wyoung
|
59 |
When the JavaScript in the "download.js" file runs, it requests |
|
fb38d31…
|
drh
|
60 |
a listing of all unversioned content using the /juvlist URL. |
|
fb38d31…
|
drh
|
61 |
([/juvlist|sample /juvlist output]). The content of the download page is |
|
fb38d31…
|
drh
|
62 |
constructed by matching unversioned files against regular expressions |
|
fb38d31…
|
drh
|
63 |
in the "releases" variable. |
|
fb38d31…
|
drh
|
64 |
|
|
fb38d31…
|
drh
|
65 |
Build products need to be constructed on different machines. The precompiled |
|
fb38d31…
|
drh
|
66 |
binary for Linux is compiled on Linux, the precompiled binary for Windows |
|
f5d1c5e…
|
drh
|
67 |
is compiled on Windows11, and so forth. After a new release is tagged, |
|
fb38d31…
|
drh
|
68 |
the release manager goes around to each of the target platforms, checks |
|
fb38d31…
|
drh
|
69 |
out the release and compiles it, then runs |
|
c64f28d…
|
drh
|
70 |
[/help/uv|fossil uv add] for the build product followed by |
|
c64f28d…
|
drh
|
71 |
[/help/uv|fossil uv sync] to push the new build product to the |
|
fb38d31…
|
drh
|
72 |
[./selfhost.wiki|various servers]. This process is repeated for |
|
fb38d31…
|
drh
|
73 |
each build product. |
|
fb38d31…
|
drh
|
74 |
|
|
fb38d31…
|
drh
|
75 |
When older builds are retired from the download page, the |
|
498cfbf…
|
drh
|
76 |
[/uv/download.js?mimetype=text/plain|download.js] page is again |
|
fb38d31…
|
drh
|
77 |
edited to remove the corresponding entry from the "release" variable |
|
fb38d31…
|
drh
|
78 |
and the edit is synced using |
|
c64f28d…
|
drh
|
79 |
[/help/uv|fossil uv sync]. This causes the build products to |
|
fb38d31…
|
drh
|
80 |
disappear from the download page immediately. But those build products |
|
fb38d31…
|
drh
|
81 |
are still taking up space in the unversioned content table of the |
|
fb38d31…
|
drh
|
82 |
server repository. To purge the obsolete build products, one or |
|
c64f28d…
|
drh
|
83 |
more [/help/uv|fossil uv rm] commands are run, followed by |
|
c64f28d…
|
drh
|
84 |
another [/help/uv|fossil uv sync]. It is important to purge |
|
fb38d31…
|
drh
|
85 |
obsolete build products since they take up a lot of space. |
|
fb38d31…
|
drh
|
86 |
At [/repo-tabsize] you can see that the unversioned table takes up |
|
fb38d31…
|
drh
|
87 |
a substantial fraction of the repository. |
|
914d532…
|
drh
|
88 |
|
|
914d532…
|
drh
|
89 |
<h2>3.0 Security</h2> |
|
914d532…
|
drh
|
90 |
|
|
914d532…
|
drh
|
91 |
Only users with the [/setup_ulist_notes|"y" permission] are allowed |
|
914d532…
|
drh
|
92 |
to push unversioned content up to the servers. Having the ability |
|
914d532…
|
drh
|
93 |
to push check-ins (the [/setup_ulist_notes|"i" permission]) is not |
|
914d532…
|
drh
|
94 |
sufficient. |
|
914d532…
|
drh
|
95 |
|
|
c9614f1…
|
stephan
|
96 |
On the Fossil project there are (as of 2023-07-31) 71 people who have |
|
c9614f1…
|
stephan
|
97 |
check-in privileges. But only the project lead can push unversioned |
|
c9614f1…
|
stephan
|
98 |
content and thus change the build products on the download page. |
|
c9614f1…
|
stephan
|
99 |
Minimizing the number of people who can change the build products |
|
c9614f1…
|
stephan
|
100 |
helps to ensure that rogue binaries do not slip onto the download page |
|
c9614f1…
|
stephan
|
101 |
unnoticed. |