Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

x/website: talks.godoc.org's present server still relies on defunct RawGit service #46469

Open
jub0bs opened this issue May 31, 2021 · 6 comments
Labels
NeedsInvestigation Someone must examine and confirm this is a valid issue and not a duplicate of an existing one. website

Comments

@jub0bs
Copy link

jub0bs commented May 31, 2021

One can (and the likes of Dave Cheney do) point talks.godoc.org to one's present slideshow hosted on GitHub. The slideshow then runs on the server, which obviates the need for installing and running the present command on one's local machine. For instance, see https://talks.godoc.org/github.com/jub0bs/poc_present/main.slide.

However, I noticed that SVG assets hosted raw.githubusercontent.com see their URL's host rewritten to rawgithub.com. https://rawgithub.com permanently redirects to https://rawgit.com, which states that the RawGit project is reaching the end of its life:

RawGit is now in a sunset phase and will soon shut down. It's been a fun five years, but all things must end. [...] If you're currently using RawGit, please stop using it as soon as you can.

(my emphasis)

As a result of this URL rewrite and the RawGit project's status, such SVG assets fail to load (with a 403 response status) in present slides run on talks.godoc.org; for instance, see https://talks.godoc.org/github.com/jub0bs/poc_present/main.slide#2:

failure to load SVG in slideshow

Note: a WHOIS lookup confirms that godoc.org is owned by Google; talks.godoc.org is maintained by @dmitshur.

I tracked down the offending URL rewrite to the golang/gddo project, but that project is marked as archived and no longer accepts issues or pull requests. I privately reached out to @julieqiu for guidance on Gophers Slack, who suggested I open an issue about this here.

Relying on RawGit despite its sunset status may have security implications: when RawGit becomes truly defunct, its domain names may be acquired by a malevolent actor who could serve arbitrary SVGs in place of the slideshow's authors'. I've privately reached out to Ryan Grove (RawGit's author) on Twitter, who indicated he has no plans to let domain names rawgithub.com and rawgit.com lapse any time soon, but his plans may change, especially if the cost of ownership becomes prohibitive.

Moreover, the ability to run a slideshow on https://talks.godoc.org is valuable to the community, and isn't yet (AFAIK) supported on https://pkg.go.dev. Fixing this issue (by no longer relying on RawGit) would be a good thing.

@gopherbot gopherbot added this to the Unreleased milestone May 31, 2021
@seankhliao seankhliao added the NeedsInvestigation Someone must examine and confirm this is a valid issue and not a duplicate of an existing one. label May 31, 2021
@seankhliao
Copy link
Member

maybe the rewrite could just be removed since github now serves svgs with content-type: image/svg+xml

@jub0bs
Copy link
Author

jub0bs commented Jun 21, 2021

Is there anything I can do to help? Could I submit a patch somewhere (if not on the golang/gddo repo, since it's archived)?

@jub0bs
Copy link
Author

jub0bs commented Nov 8, 2022

No progress in a year and a half on this. I'd like to renew my offer to help, if I can.

@jub0bs
Copy link
Author

jub0bs commented Dec 9, 2022

The problem persists to this day, and rawgithub.com expires at the end of January 2023.

Edit (2023/03/07): rawgithub.com was renewed until January 2024.

@ncruces
Copy link
Contributor

ncruces commented Feb 28, 2023

I tried fixing a documentation link in #36692 and, in the end, no one merged it. 🤷

@lhogan3
Copy link

lhogan3 commented Mar 6, 2023

Is there any update on this? I just started receiving 403s for all content I have been trying to access because of this?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
NeedsInvestigation Someone must examine and confirm this is a valid issue and not a duplicate of an existing one. website
Projects
None yet
Development

No branches or pull requests

6 participants