Images don't load at <https://rustup.rs> due to content security policy

[XrXr]

Verification

• I searched for recent similar issues at https://github.com/rust-lang/rustup/issues?q=is%3Aissue and found no duplicates.
• I am on the latest version of Rustup according to https://github.com/rust-lang/rustup/tags and am still able to reproduce my issue.

Problem

The Rust logo in front of "rustup is an official Rust project" doesn't load shows up as a blank square:

In the browser console:

Content-Security-Policy: The page’s settings blocked the loading of a resource (img-src) at https://rust-lang.org/logos/rust-logo-blk.svg because it violates the following directive: “img-src 'self' https://www.rust-lang.org/” [rustup.rs](https://rustup.rs/)
A resource is blocked by OpaqueResponseBlocking, please check browser console for details. [rust-logo-blk.svg](https://www.rust-lang.org/logos/rust-logo-blk.svg)
Content-Security-Policy: The page’s settings blocked the loading of a resource (img-src) at https://rust-lang.org/static/images/favicon.svg because it violates the following directive: “img-src 'self' https://www.rust-lang.org/”

Steps

Visit https://rustup.rs

Possible Solution(s)

No response

Notes

No response

Rustup version

N/A

Installed toolchains

N/A

OS version

N/A

[djc]

I thought we fixed this in #4533. Maybe that didn't deploy correctly or there's more we need to do for deployment?

Or maybe this is a related but slightly different issue?

[XrXr]

I guess it didn't deploy properly. #4533 should remove "www." from the CSP header but:

$ curl -sI https://rustup.rs | rg content-security
content-security-policy: default-src 'none'; script-src 'self'; style-src 'self'; img-src 'self' https://www.rust-lang.org; font-src 'self'

[ehuss]

I believe the website is part of the rustup release process. That is, I think you need to publish a new release.

[djc]

Hmm, maybe we should decouple that to get more continuous deployment of the website...

[case]

^^ Bumping this, as I noticed it today as well while working on a Rust project.

Is there anything we can do to help, @djc?

[djc]

I don't have time right now to look into how this is deployed and how we could decouple it. If you could, that might be helpful.

[Bogay]

The production website is deployed via sync-dist.py, as described in step 8 of the release process. This step is currently executed manually by the release team. Since the process just involves copying static files and the installation commands on rustup.rs are generic (not version-specific), decoupling this from the main release should be straightforward and low-risk.

rustup/ci/sync-dist.py

Lines 145 to 161 in 28d1352

	if command == "local-to-prod":
	run_s3cmd("aws s3 cp ./local-rustup/rustup-init.sh s3://{}/rustup/rustup-init.sh"
	.format(s3_bucket))
	run_s3cmd("aws s3 cp ./local-rustup/rustup-init.sh s3://{}/rustup.sh"
	.format(s3_bucket))
	run_s3cmd("aws s3 cp --recursive ./local-rustup/www/ s3://{}/rustup/www/"
	.format(s3_bucket))
	if live_run:
	# Invalidate sh.rustup.rs
	run_s3cmd("aws cloudfront create-invalidation --distribution-id " +
	"E70E9RGZ6Q27W --paths /*".format(s3_bucket))
	# Invalidate win.rustup.rs
	run_s3cmd("aws cloudfront create-invalidation --distribution-id " +
	"E2XBMULPACBLNE --paths /*".format(s3_bucket))
	# Invalidate rustup.rs
	run_s3cmd("aws cloudfront create-invalidation --distribution-id " +
	"EVJCMYBQ0EX26 --paths /*".format(s3_bucket))

[rami3l]

FYI the release PR has been merged and the actual release will happen next week (because this week the release team has to prioritize Rust's own release).

[djc]

The production website is deployed via sync-dist.py, as described in step 8 of the release process. This step is currently executed manually by the release team. Since the process just involves copying static files and the installation commands on rustup.rs are generic (not version-specific), decoupling this from the main release should be straightforward and low-risk.

@rust-lang/release any suggestions on how we could get this automated and continuously deployed from GH Actions?

[Mark-Simulacrum]

I presume you mean outside of the normal (manual and relatively rare) release process?

I think the best bet is going to be to grant rustup's CI (merge queues or main branch CI or similar) permissions to upload to the relevant locations in the S3 bucket and issue CloudFront invalidations. That should be fairly straightforward to do, we do similarly shaped things in a bunch of different places across Rust infrastructure. I'm not too familiar with your development processes so we'd need to discuss how you want to shape that (e.g., which branch, how/if you want a preview, etc.)

[djc]

I presume you mean outside of the normal (manual and relatively rare) release process?

Yes. I think we should just do it for every merge to main. I don't think a preview is a hard blocker, though it might be nice to have.

[rami3l]

The production website is deployed via sync-dist.py, as described in step 8 of the release process. This step is currently executed manually by the release team. Since the process just involves copying static files and the installation commands on rustup.rs are generic (not version-specific), decoupling this from the main release should be straightforward and low-risk.

@Bogay Thanks for pointing that out but, given that the script will be deprecated when #3844 lands, for now all I want is for relevant players from t-infra and/or t-release to pick that up. I think t-rustup would like to provide any kind of help within our reach.

[Kobzol]

If you want to deploy after every push to the main branch to rustup.rs, I think that should be fairly simple, as Mark said. We could even move the website to GH Pages if it's not already there, as we did with the Rust website.

Let me know if t-rustup wants that, and I'll get it done with t-infra's help.