Compilation results for cp2044.codfw.wmnet: System changes detected

You can retrieve this result from host.json.

Catalog differences

Summary

Total Resources:	3969
Resources added:	0
Resources removed:	0
Resources modified:	10
Change percentage:	0.25%

Resources modified

File[/usr/share/varnish/tests/upload-frontend.inc.vcl]

Content differences:

--- /usr/share/varnish/tests/upload-frontend.inc.vcl.orig
+++ /usr/share/varnish/tests/upload-frontend.inc.vcl
@@ -580,23 +580,13 @@
         // Restrict uploads from loading external resources across all of upload.w.o (T117618)
         // PDFs require object-src: self
         if ( req.url ~ "(?i)\.pdf$" ) {
-            set resp.http.Content-Security-Policy-Report-Only = "default-src 'none'; style-src 'unsafe-inline' data:; font-src data:; img-src data: https://upload.wikimedia.org/favicon.ico; connect-src https://upload.wikimedia.org/favicon.ico; media-src data: 'self'; object-src 'self'; report-uri https://commons.wikimedia.org/w/api.php?reportonly=1&source=image&action=cspreport&format=json&";
+            set resp.http.Reporting-Endpoints = "csp-endpoint="https://commons.wikimedia.org/w/api.php?reportonly=1&source=image&action=cspreport&format=json&"";
+            set resp.http.Content-Security-Policy-Report-Only = "default-src 'none'; style-src 'unsafe-inline' data:; font-src data:; img-src data: https://upload.wikimedia.org/favicon.ico; connect-src https://upload.wikimedia.org/favicon.ico; media-src data: 'self'; object-src 'self'; report-uri https://commons.wikimedia.org/w/api.php?reportonly=1&source=image&action=cspreport&format=json&; report-to csp_endpoint";
             set resp.http.X-Content-Security-Policy-Report-Only = resp.http.Content-Security-Policy-Report-Only;
         } else {
-            set resp.http.Content-Security-Policy-Report-Only = "default-src 'none'; style-src 'unsafe-inline' data:; font-src data:; img-src data: https://upload.wikimedia.org/favicon.ico; connect-src https://upload.wikimedia.org/favicon.ico; media-src data: 'self'; report-uri https://commons.wikimedia.org/w/api.php?reportonly=1&source=image&action=cspreport&format=json&";
+            set resp.http.Reporting-Endpoints = "csp-endpoint="https://commons.wikimedia.org/w/api.php?reportonly=1&source=image&action=cspreport&format=json&"";
+            set resp.http.Content-Security-Policy-Report-Only = "default-src 'none'; style-src 'unsafe-inline' data:; font-src data:; img-src data: https://upload.wikimedia.org/favicon.ico; connect-src https://upload.wikimedia.org/favicon.ico; media-src data: 'self'; report-uri https://commons.wikimedia.org/w/api.php?reportonly=1&source=image&action=cspreport&format=json&; report-to csp_endpoint";
             set resp.http.X-Content-Security-Policy-Report-Only = resp.http.Content-Security-Policy-Report-Only;
-        }
-
-        // Testwiki now in enforce mode
-        if (req.url ~ "^/wikipedia/test") {
-            if ( req.url ~ "(?i)\.pdf$" ) {
-                // PDFs don't like no object-src and sandbox in chrome
-                set resp.http.Content-Security-Policy = "default-src 'none'; style-src 'unsafe-inline' data:; font-src data:; img-src data: https://upload.wikimedia.org/favicon.ico; connect-src https://upload.wikimedia.org/favicon.ico; media-src data: 'self'; object-src 'self'; report-uri https://commons.wikimedia.org/w/api.php?reportonly=0&source=image&action=cspreport&format=json&";
-                set resp.http.X-Content-Security-Policy = "default-src 'none'; style-src 'unsafe-inline' data:; font-src data:; img-src data: https://upload.wikimedia.org/favicon.ico; connect-src https://upload.wikimedia.org/favicon.ico; media-src data: 'self'; object-src 'self'; report-uri https://commons.wikimedia.org/w/api.php?reportonly=0&source=image&action=cspreport&format=json&";
-            } else {
-                set resp.http.Content-Security-Policy = "default-src 'none'; style-src 'unsafe-inline' data:; font-src data:; img-src data: https://upload.wikimedia.org/favicon.ico; connect-src https://upload.wikimedia.org/favicon.ico; media-src data: 'self'; sandbox; report-uri https://commons.wikimedia.org/w/api.php?reportonly=0&source=image&action=cspreport&format=json&";
-                set resp.http.X-Content-Security-Policy = "default-src 'none'; style-src 'unsafe-inline' data:; font-src data:; img-src data: https://upload.wikimedia.org/favicon.ico; connect-src https://upload.wikimedia.org/favicon.ico; media-src data: 'self'; sandbox; report-uri https://commons.wikimedia.org/w/api.php?reportonly=0&source=image&action=cspreport&format=json&";
-            }
         }
     }

Varnish::Wikimedia_vcl[/etc/varnish/upload-frontend.inc.vcl]

Parameters differences:

--- Varnish::Wikimedia_vcl[/etc/varnish/upload-frontend.inc.vcl].orig
+++ Varnish::Wikimedia_vcl[/etc/varnish/upload-frontend.inc.vcl]

@@
-    vcl_config => {'purge_host_regex': '^(upload|maps)\\.wikimedia\\.org$', 'upload_domain': 'upload.wikimedia.org', 'upload_webp_hits_threshold': 100, 'maps_domain': 'maps.wikimedia.org', 'measure_domain_regex': '^measure-(eqiad|codfw|esams|ulsfo|eqsin|drmrs|magru)\\.wikimedia\\.org$', 'pass_random': False, 'admission_policy': 'exp', 'exp_policy_rate': 0.2, 'exp_policy_base': -20.3, 'large_objects_cutoff': 8388608, 'varnish_probe_ms': 100, 'keep': '1d', 'public_clouds_shutdown': False, 'attack_mode': False, 'differential_privacy': False, 'edge_uniques_same_site': 'None', 'req_handling': {'default': {'caching': 'normal'}}, 'alternate_domains': {}, 'fe_mem_gb': 334, 'do_esitest': False, 'beacon_uri_regex': '^/beacon\\/(?!event)[^/?]+', 'do_edge_uniques': True, 'edge_uniques_key_path': '/etc/varnish/uniques.d/keys.cfg', 'edge_uniques_cfg_path': '/etc/varnish/uniques.json'}
+    vcl_config => {'purge_host_regex': '^(upload|maps)\\.wikimedia\\.org$', 'upload_domain': 'upload.wikimedia.org', 'upload_webp_hits_threshold': 100, 'maps_domain': 'maps.wikimedia.org', 'measure_domain_regex': '^measure-(eqiad|codfw|esams|ulsfo|eqsin|drmrs|magru)\\.wikimedia\\.org$', 'pass_random': False, 'admission_policy': 'exp', 'exp_policy_rate': 0.2, 'exp_policy_base': -20.3, 'large_objects_cutoff': 8388608, 'varnish_probe_ms': 100, 'keep': '1d', 'public_clouds_shutdown': False, 'attack_mode': False, 'differential_privacy': False, 'edge_uniques_same_site': 'None', 'pdf_csp_header': "default-src 'none'; style-src 'unsafe-inline' data:; font-src data:; img-src data: https://upload.wikimedia.org/favicon.ico; connect-src https://upload.wikimedia.org/favicon.ico; media-src data: 'self'; object-src 'self'; report-uri https://commons.wikimedia.org/w/api.php?reportonly=1&source=image&action=cspreport&format=json&; report-to csp_endpoint", 'csp_header': "default-src 'none'; style-src 'unsafe-inline' data:; font-src data:; img-src data: https://upload.wikimedia.org/favicon.ico; connect-src https://upload.wikimedia.org/favicon.ico; media-src data: 'self'; report-uri https://commons.wikimedia.org/w/api.php?reportonly=1&source=image&action=cspreport&format=json&; report-to csp_endpoint", 'reporting_endpoints': 'csp-endpoint="https://commons.wikimedia.org/w/api.php?reportonly=1&source=image&action=cspreport&format=json&"', 'req_handling': {'default': {'caching': 'normal'}}, 'alternate_domains': {}, 'fe_mem_gb': 334, 'do_esitest': False, 'beacon_uri_regex': '^/beacon\\/(?!event)[^/?]+', 'do_edge_uniques': True, 'edge_uniques_key_path': '/etc/varnish/uniques.d/keys.cfg', 'edge_uniques_cfg_path': '/etc/varnish/uniques.json'}

Varnish::Wikimedia_vcl[/etc/varnish/wikimedia_upload-frontend.vcl]

Parameters differences:

--- Varnish::Wikimedia_vcl[/etc/varnish/wikimedia_upload-frontend.vcl].orig
+++ Varnish::Wikimedia_vcl[/etc/varnish/wikimedia_upload-frontend.vcl]

@@
-    vcl_config => {'purge_host_regex': '^(upload|maps)\\.wikimedia\\.org$', 'upload_domain': 'upload.wikimedia.org', 'upload_webp_hits_threshold': 100, 'maps_domain': 'maps.wikimedia.org', 'measure_domain_regex': '^measure-(eqiad|codfw|esams|ulsfo|eqsin|drmrs|magru)\\.wikimedia\\.org$', 'pass_random': False, 'admission_policy': 'exp', 'exp_policy_rate': 0.2, 'exp_policy_base': -20.3, 'large_objects_cutoff': 8388608, 'varnish_probe_ms': 100, 'keep': '1d', 'public_clouds_shutdown': False, 'attack_mode': False, 'differential_privacy': False, 'edge_uniques_same_site': 'None', 'req_handling': {'default': {'caching': 'normal'}}, 'alternate_domains': {}, 'fe_mem_gb': 334, 'do_esitest': False, 'beacon_uri_regex': '^/beacon\\/(?!event)[^/?]+', 'do_edge_uniques': True, 'edge_uniques_key_path': '/etc/varnish/uniques.d/keys.cfg', 'edge_uniques_cfg_path': '/etc/varnish/uniques.json'}
+    vcl_config => {'purge_host_regex': '^(upload|maps)\\.wikimedia\\.org$', 'upload_domain': 'upload.wikimedia.org', 'upload_webp_hits_threshold': 100, 'maps_domain': 'maps.wikimedia.org', 'measure_domain_regex': '^measure-(eqiad|codfw|esams|ulsfo|eqsin|drmrs|magru)\\.wikimedia\\.org$', 'pass_random': False, 'admission_policy': 'exp', 'exp_policy_rate': 0.2, 'exp_policy_base': -20.3, 'large_objects_cutoff': 8388608, 'varnish_probe_ms': 100, 'keep': '1d', 'public_clouds_shutdown': False, 'attack_mode': False, 'differential_privacy': False, 'edge_uniques_same_site': 'None', 'pdf_csp_header': "default-src 'none'; style-src 'unsafe-inline' data:; font-src data:; img-src data: https://upload.wikimedia.org/favicon.ico; connect-src https://upload.wikimedia.org/favicon.ico; media-src data: 'self'; object-src 'self'; report-uri https://commons.wikimedia.org/w/api.php?reportonly=1&source=image&action=cspreport&format=json&; report-to csp_endpoint", 'csp_header': "default-src 'none'; style-src 'unsafe-inline' data:; font-src data:; img-src data: https://upload.wikimedia.org/favicon.ico; connect-src https://upload.wikimedia.org/favicon.ico; media-src data: 'self'; report-uri https://commons.wikimedia.org/w/api.php?reportonly=1&source=image&action=cspreport&format=json&; report-to csp_endpoint", 'reporting_endpoints': 'csp-endpoint="https://commons.wikimedia.org/w/api.php?reportonly=1&source=image&action=cspreport&format=json&"', 'req_handling': {'default': {'caching': 'normal'}}, 'alternate_domains': {}, 'fe_mem_gb': 334, 'do_esitest': False, 'beacon_uri_regex': '^/beacon\\/(?!event)[^/?]+', 'do_edge_uniques': True, 'edge_uniques_key_path': '/etc/varnish/uniques.d/keys.cfg', 'edge_uniques_cfg_path': '/etc/varnish/uniques.json'}

Varnish::Instance[upload-frontend]

Parameters differences:

--- Varnish::Instance[upload-frontend].orig
+++ Varnish::Instance[upload-frontend]

@@
-    vcl_config => {'purge_host_regex': '^(upload|maps)\\.wikimedia\\.org$', 'upload_domain': 'upload.wikimedia.org', 'upload_webp_hits_threshold': 100, 'maps_domain': 'maps.wikimedia.org', 'measure_domain_regex': '^measure-(eqiad|codfw|esams|ulsfo|eqsin|drmrs|magru)\\.wikimedia\\.org$', 'pass_random': False, 'admission_policy': 'exp', 'exp_policy_rate': 0.2, 'exp_policy_base': -20.3, 'large_objects_cutoff': 8388608, 'varnish_probe_ms': 100, 'keep': '1d', 'public_clouds_shutdown': False, 'attack_mode': False, 'differential_privacy': False, 'edge_uniques_same_site': 'None', 'req_handling': {'default': {'caching': 'normal'}}, 'alternate_domains': {}, 'fe_mem_gb': 334, 'do_esitest': False, 'beacon_uri_regex': '^/beacon\\/(?!event)[^/?]+', 'do_edge_uniques': True, 'edge_uniques_key_path': '/etc/varnish/uniques.d/keys.cfg', 'edge_uniques_cfg_path': '/etc/varnish/uniques.json'}
+    vcl_config => {'purge_host_regex': '^(upload|maps)\\.wikimedia\\.org$', 'upload_domain': 'upload.wikimedia.org', 'upload_webp_hits_threshold': 100, 'maps_domain': 'maps.wikimedia.org', 'measure_domain_regex': '^measure-(eqiad|codfw|esams|ulsfo|eqsin|drmrs|magru)\\.wikimedia\\.org$', 'pass_random': False, 'admission_policy': 'exp', 'exp_policy_rate': 0.2, 'exp_policy_base': -20.3, 'large_objects_cutoff': 8388608, 'varnish_probe_ms': 100, 'keep': '1d', 'public_clouds_shutdown': False, 'attack_mode': False, 'differential_privacy': False, 'edge_uniques_same_site': 'None', 'pdf_csp_header': "default-src 'none'; style-src 'unsafe-inline' data:; font-src data:; img-src data: https://upload.wikimedia.org/favicon.ico; connect-src https://upload.wikimedia.org/favicon.ico; media-src data: 'self'; object-src 'self'; report-uri https://commons.wikimedia.org/w/api.php?reportonly=1&source=image&action=cspreport&format=json&; report-to csp_endpoint", 'csp_header': "default-src 'none'; style-src 'unsafe-inline' data:; font-src data:; img-src data: https://upload.wikimedia.org/favicon.ico; connect-src https://upload.wikimedia.org/favicon.ico; media-src data: 'self'; report-uri https://commons.wikimedia.org/w/api.php?reportonly=1&source=image&action=cspreport&format=json&; report-to csp_endpoint", 'reporting_endpoints': 'csp-endpoint="https://commons.wikimedia.org/w/api.php?reportonly=1&source=image&action=cspreport&format=json&"', 'req_handling': {'default': {'caching': 'normal'}}, 'alternate_domains': {}, 'fe_mem_gb': 334, 'do_esitest': False, 'beacon_uri_regex': '^/beacon\\/(?!event)[^/?]+', 'do_edge_uniques': True, 'edge_uniques_key_path': '/etc/varnish/uniques.d/keys.cfg', 'edge_uniques_cfg_path': '/etc/varnish/uniques.json'}

Class[Varnish::Common::Vcl]

Parameters differences:

--- Class[Varnish::Common::Vcl].orig
+++ Class[Varnish::Common::Vcl]

@@
-    vcl_config => {'purge_host_regex': '^(upload|maps)\\.wikimedia\\.org$', 'upload_domain': 'upload.wikimedia.org', 'upload_webp_hits_threshold': 100, 'maps_domain': 'maps.wikimedia.org', 'measure_domain_regex': '^measure-(eqiad|codfw|esams|ulsfo|eqsin|drmrs|magru)\\.wikimedia\\.org$', 'pass_random': False, 'admission_policy': 'exp', 'exp_policy_rate': 0.2, 'exp_policy_base': -20.3, 'large_objects_cutoff': 8388608, 'varnish_probe_ms': 100, 'keep': '1d', 'public_clouds_shutdown': False, 'attack_mode': False, 'differential_privacy': False, 'edge_uniques_same_site': 'None', 'req_handling': {'default': {'caching': 'normal'}}, 'alternate_domains': {}, 'fe_mem_gb': 334, 'do_esitest': False, 'beacon_uri_regex': '^/beacon\\/(?!event)[^/?]+', 'do_edge_uniques': True, 'edge_uniques_key_path': '/etc/varnish/uniques.d/keys.cfg', 'edge_uniques_cfg_path': '/etc/varnish/uniques.json'}
+    vcl_config => {'purge_host_regex': '^(upload|maps)\\.wikimedia\\.org$', 'upload_domain': 'upload.wikimedia.org', 'upload_webp_hits_threshold': 100, 'maps_domain': 'maps.wikimedia.org', 'measure_domain_regex': '^measure-(eqiad|codfw|esams|ulsfo|eqsin|drmrs|magru)\\.wikimedia\\.org$', 'pass_random': False, 'admission_policy': 'exp', 'exp_policy_rate': 0.2, 'exp_policy_base': -20.3, 'large_objects_cutoff': 8388608, 'varnish_probe_ms': 100, 'keep': '1d', 'public_clouds_shutdown': False, 'attack_mode': False, 'differential_privacy': False, 'edge_uniques_same_site': 'None', 'pdf_csp_header': "default-src 'none'; style-src 'unsafe-inline' data:; font-src data:; img-src data: https://upload.wikimedia.org/favicon.ico; connect-src https://upload.wikimedia.org/favicon.ico; media-src data: 'self'; object-src 'self'; report-uri https://commons.wikimedia.org/w/api.php?reportonly=1&source=image&action=cspreport&format=json&; report-to csp_endpoint", 'csp_header': "default-src 'none'; style-src 'unsafe-inline' data:; font-src data:; img-src data: https://upload.wikimedia.org/favicon.ico; connect-src https://upload.wikimedia.org/favicon.ico; media-src data: 'self'; report-uri https://commons.wikimedia.org/w/api.php?reportonly=1&source=image&action=cspreport&format=json&; report-to csp_endpoint", 'reporting_endpoints': 'csp-endpoint="https://commons.wikimedia.org/w/api.php?reportonly=1&source=image&action=cspreport&format=json&"', 'req_handling': {'default': {'caching': 'normal'}}, 'alternate_domains': {}, 'fe_mem_gb': 334, 'do_esitest': False, 'beacon_uri_regex': '^/beacon\\/(?!event)[^/?]+', 'do_edge_uniques': True, 'edge_uniques_key_path': '/etc/varnish/uniques.d/keys.cfg', 'edge_uniques_cfg_path': '/etc/varnish/uniques.json'}

Varnish::Wikimedia_vcl[/usr/share/varnish/tests/upload-frontend.inc.vcl]

Parameters differences:

--- Varnish::Wikimedia_vcl[/usr/share/varnish/tests/upload-frontend.inc.vcl].orig
+++ Varnish::Wikimedia_vcl[/usr/share/varnish/tests/upload-frontend.inc.vcl]

@@
-    vcl_config => {'purge_host_regex': '^(upload|maps)\\.wikimedia\\.org$', 'upload_domain': 'upload.wikimedia.org', 'upload_webp_hits_threshold': 100, 'maps_domain': 'maps.wikimedia.org', 'measure_domain_regex': '^measure-(eqiad|codfw|esams|ulsfo|eqsin|drmrs|magru)\\.wikimedia\\.org$', 'pass_random': False, 'admission_policy': 'exp', 'exp_policy_rate': 0.2, 'exp_policy_base': -20.3, 'large_objects_cutoff': 8388608, 'varnish_probe_ms': 100, 'keep': '1d', 'public_clouds_shutdown': False, 'attack_mode': False, 'differential_privacy': False, 'edge_uniques_same_site': 'None', 'req_handling': {'default': {'caching': 'normal'}}, 'alternate_domains': {}, 'fe_mem_gb': 334, 'do_esitest': False, 'beacon_uri_regex': '^/beacon\\/(?!event)[^/?]+', 'do_edge_uniques': True, 'edge_uniques_key_path': '/etc/varnish/uniques.d/keys.cfg', 'edge_uniques_cfg_path': '/etc/varnish/uniques.json'}
+    vcl_config => {'purge_host_regex': '^(upload|maps)\\.wikimedia\\.org$', 'upload_domain': 'upload.wikimedia.org', 'upload_webp_hits_threshold': 100, 'maps_domain': 'maps.wikimedia.org', 'measure_domain_regex': '^measure-(eqiad|codfw|esams|ulsfo|eqsin|drmrs|magru)\\.wikimedia\\.org$', 'pass_random': False, 'admission_policy': 'exp', 'exp_policy_rate': 0.2, 'exp_policy_base': -20.3, 'large_objects_cutoff': 8388608, 'varnish_probe_ms': 100, 'keep': '1d', 'public_clouds_shutdown': False, 'attack_mode': False, 'differential_privacy': False, 'edge_uniques_same_site': 'None', 'pdf_csp_header': "default-src 'none'; style-src 'unsafe-inline' data:; font-src data:; img-src data: https://upload.wikimedia.org/favicon.ico; connect-src https://upload.wikimedia.org/favicon.ico; media-src data: 'self'; object-src 'self'; report-uri https://commons.wikimedia.org/w/api.php?reportonly=1&source=image&action=cspreport&format=json&; report-to csp_endpoint", 'csp_header': "default-src 'none'; style-src 'unsafe-inline' data:; font-src data:; img-src data: https://upload.wikimedia.org/favicon.ico; connect-src https://upload.wikimedia.org/favicon.ico; media-src data: 'self'; report-uri https://commons.wikimedia.org/w/api.php?reportonly=1&source=image&action=cspreport&format=json&; report-to csp_endpoint", 'reporting_endpoints': 'csp-endpoint="https://commons.wikimedia.org/w/api.php?reportonly=1&source=image&action=cspreport&format=json&"', 'req_handling': {'default': {'caching': 'normal'}}, 'alternate_domains': {}, 'fe_mem_gb': 334, 'do_esitest': False, 'beacon_uri_regex': '^/beacon\\/(?!event)[^/?]+', 'do_edge_uniques': True, 'edge_uniques_key_path': '/etc/varnish/uniques.d/keys.cfg', 'edge_uniques_cfg_path': '/etc/varnish/uniques.json'}

Varnish::Wikimedia_vcl[/usr/share/varnish/tests/wikimedia_upload-frontend.vcl]

Parameters differences:

--- Varnish::Wikimedia_vcl[/usr/share/varnish/tests/wikimedia_upload-frontend.vcl].orig
+++ Varnish::Wikimedia_vcl[/usr/share/varnish/tests/wikimedia_upload-frontend.vcl]

@@
-    vcl_config => {'purge_host_regex': '^(upload|maps)\\.wikimedia\\.org$', 'upload_domain': 'upload.wikimedia.org', 'upload_webp_hits_threshold': 100, 'maps_domain': 'maps.wikimedia.org', 'measure_domain_regex': '^measure-(eqiad|codfw|esams|ulsfo|eqsin|drmrs|magru)\\.wikimedia\\.org$', 'pass_random': False, 'admission_policy': 'exp', 'exp_policy_rate': 0.2, 'exp_policy_base': -20.3, 'large_objects_cutoff': 8388608, 'varnish_probe_ms': 100, 'keep': '1d', 'public_clouds_shutdown': False, 'attack_mode': False, 'differential_privacy': False, 'edge_uniques_same_site': 'None', 'req_handling': {'default': {'caching': 'normal'}}, 'alternate_domains': {}, 'fe_mem_gb': 334, 'do_esitest': False, 'beacon_uri_regex': '^/beacon\\/(?!event)[^/?]+', 'do_edge_uniques': True, 'edge_uniques_key_path': '/etc/varnish/uniques.d/keys.cfg', 'edge_uniques_cfg_path': '/etc/varnish/uniques.json'}
+    vcl_config => {'purge_host_regex': '^(upload|maps)\\.wikimedia\\.org$', 'upload_domain': 'upload.wikimedia.org', 'upload_webp_hits_threshold': 100, 'maps_domain': 'maps.wikimedia.org', 'measure_domain_regex': '^measure-(eqiad|codfw|esams|ulsfo|eqsin|drmrs|magru)\\.wikimedia\\.org$', 'pass_random': False, 'admission_policy': 'exp', 'exp_policy_rate': 0.2, 'exp_policy_base': -20.3, 'large_objects_cutoff': 8388608, 'varnish_probe_ms': 100, 'keep': '1d', 'public_clouds_shutdown': False, 'attack_mode': False, 'differential_privacy': False, 'edge_uniques_same_site': 'None', 'pdf_csp_header': "default-src 'none'; style-src 'unsafe-inline' data:; font-src data:; img-src data: https://upload.wikimedia.org/favicon.ico; connect-src https://upload.wikimedia.org/favicon.ico; media-src data: 'self'; object-src 'self'; report-uri https://commons.wikimedia.org/w/api.php?reportonly=1&source=image&action=cspreport&format=json&; report-to csp_endpoint", 'csp_header': "default-src 'none'; style-src 'unsafe-inline' data:; font-src data:; img-src data: https://upload.wikimedia.org/favicon.ico; connect-src https://upload.wikimedia.org/favicon.ico; media-src data: 'self'; report-uri https://commons.wikimedia.org/w/api.php?reportonly=1&source=image&action=cspreport&format=json&; report-to csp_endpoint", 'reporting_endpoints': 'csp-endpoint="https://commons.wikimedia.org/w/api.php?reportonly=1&source=image&action=cspreport&format=json&"', 'req_handling': {'default': {'caching': 'normal'}}, 'alternate_domains': {}, 'fe_mem_gb': 334, 'do_esitest': False, 'beacon_uri_regex': '^/beacon\\/(?!event)[^/?]+', 'do_edge_uniques': True, 'edge_uniques_key_path': '/etc/varnish/uniques.d/keys.cfg', 'edge_uniques_cfg_path': '/etc/varnish/uniques.json'}

Class[Profile::Cache::Varnish::Frontend]

Parameters differences:

--- Class[Profile::Cache::Varnish::Frontend].orig
+++ Class[Profile::Cache::Varnish::Frontend]

@@
-    fe_vcl_config => {'purge_host_regex': '^(upload|maps)\\.wikimedia\\.org$', 'upload_domain': 'upload.wikimedia.org', 'upload_webp_hits_threshold': 100, 'maps_domain': 'maps.wikimedia.org', 'measure_domain_regex': '^measure-(eqiad|codfw|esams|ulsfo|eqsin|drmrs|magru)\\.wikimedia\\.org$', 'pass_random': False, 'admission_policy': 'exp', 'exp_policy_rate': 0.2, 'exp_policy_base': -20.3, 'large_objects_cutoff': 8388608, 'varnish_probe_ms': 100, 'keep': '1d', 'public_clouds_shutdown': False, 'attack_mode': False, 'differential_privacy': False, 'edge_uniques_same_site': 'None'}
+    fe_vcl_config => {'purge_host_regex': '^(upload|maps)\\.wikimedia\\.org$', 'upload_domain': 'upload.wikimedia.org', 'upload_webp_hits_threshold': 100, 'maps_domain': 'maps.wikimedia.org', 'measure_domain_regex': '^measure-(eqiad|codfw|esams|ulsfo|eqsin|drmrs|magru)\\.wikimedia\\.org$', 'pass_random': False, 'admission_policy': 'exp', 'exp_policy_rate': 0.2, 'exp_policy_base': -20.3, 'large_objects_cutoff': 8388608, 'varnish_probe_ms': 100, 'keep': '1d', 'public_clouds_shutdown': False, 'attack_mode': False, 'differential_privacy': False, 'edge_uniques_same_site': 'None', 'pdf_csp_header': "default-src 'none'; style-src 'unsafe-inline' data:; font-src data:; img-src data: https://upload.wikimedia.org/favicon.ico; connect-src https://upload.wikimedia.org/favicon.ico; media-src data: 'self'; object-src 'self'; report-uri https://commons.wikimedia.org/w/api.php?reportonly=1&source=image&action=cspreport&format=json&; report-to csp_endpoint", 'csp_header': "default-src 'none'; style-src 'unsafe-inline' data:; font-src data:; img-src data: https://upload.wikimedia.org/favicon.ico; connect-src https://upload.wikimedia.org/favicon.ico; media-src data: 'self'; report-uri https://commons.wikimedia.org/w/api.php?reportonly=1&source=image&action=cspreport&format=json&; report-to csp_endpoint", 'reporting_endpoints': 'csp-endpoint="https://commons.wikimedia.org/w/api.php?reportonly=1&source=image&action=cspreport&format=json&"'}

Varnish::Wikimedia_vcl[normalize_path -frontend]

Parameters differences:

--- Varnish::Wikimedia_vcl[normalize_path -frontend].orig
+++ Varnish::Wikimedia_vcl[normalize_path -frontend]

@@
-    vcl_config => {'purge_host_regex': '^(upload|maps)\\.wikimedia\\.org$', 'upload_domain': 'upload.wikimedia.org', 'upload_webp_hits_threshold': 100, 'maps_domain': 'maps.wikimedia.org', 'measure_domain_regex': '^measure-(eqiad|codfw|esams|ulsfo|eqsin|drmrs|magru)\\.wikimedia\\.org$', 'pass_random': False, 'admission_policy': 'exp', 'exp_policy_rate': 0.2, 'exp_policy_base': -20.3, 'large_objects_cutoff': 8388608, 'varnish_probe_ms': 100, 'keep': '1d', 'public_clouds_shutdown': False, 'attack_mode': False, 'differential_privacy': False, 'edge_uniques_same_site': 'None', 'req_handling': {'default': {'caching': 'normal'}}, 'alternate_domains': {}, 'fe_mem_gb': 334, 'do_esitest': False, 'beacon_uri_regex': '^/beacon\\/(?!event)[^/?]+', 'do_edge_uniques': True, 'edge_uniques_key_path': '/etc/varnish/uniques.d/keys.cfg', 'edge_uniques_cfg_path': '/etc/varnish/uniques.json'}
+    vcl_config => {'purge_host_regex': '^(upload|maps)\\.wikimedia\\.org$', 'upload_domain': 'upload.wikimedia.org', 'upload_webp_hits_threshold': 100, 'maps_domain': 'maps.wikimedia.org', 'measure_domain_regex': '^measure-(eqiad|codfw|esams|ulsfo|eqsin|drmrs|magru)\\.wikimedia\\.org$', 'pass_random': False, 'admission_policy': 'exp', 'exp_policy_rate': 0.2, 'exp_policy_base': -20.3, 'large_objects_cutoff': 8388608, 'varnish_probe_ms': 100, 'keep': '1d', 'public_clouds_shutdown': False, 'attack_mode': False, 'differential_privacy': False, 'edge_uniques_same_site': 'None', 'pdf_csp_header': "default-src 'none'; style-src 'unsafe-inline' data:; font-src data:; img-src data: https://upload.wikimedia.org/favicon.ico; connect-src https://upload.wikimedia.org/favicon.ico; media-src data: 'self'; object-src 'self'; report-uri https://commons.wikimedia.org/w/api.php?reportonly=1&source=image&action=cspreport&format=json&; report-to csp_endpoint", 'csp_header': "default-src 'none'; style-src 'unsafe-inline' data:; font-src data:; img-src data: https://upload.wikimedia.org/favicon.ico; connect-src https://upload.wikimedia.org/favicon.ico; media-src data: 'self'; report-uri https://commons.wikimedia.org/w/api.php?reportonly=1&source=image&action=cspreport&format=json&; report-to csp_endpoint", 'reporting_endpoints': 'csp-endpoint="https://commons.wikimedia.org/w/api.php?reportonly=1&source=image&action=cspreport&format=json&"', 'req_handling': {'default': {'caching': 'normal'}}, 'alternate_domains': {}, 'fe_mem_gb': 334, 'do_esitest': False, 'beacon_uri_regex': '^/beacon\\/(?!event)[^/?]+', 'do_edge_uniques': True, 'edge_uniques_key_path': '/etc/varnish/uniques.d/keys.cfg', 'edge_uniques_cfg_path': '/etc/varnish/uniques.json'}

File[/etc/varnish/upload-frontend.inc.vcl]

Content differences:

--- /etc/varnish/upload-frontend.inc.vcl.orig
+++ /etc/varnish/upload-frontend.inc.vcl
@@ -580,23 +580,13 @@
         // Restrict uploads from loading external resources across all of upload.w.o (T117618)
         // PDFs require object-src: self
         if ( req.url ~ "(?i)\.pdf$" ) {
-            set resp.http.Content-Security-Policy-Report-Only = "default-src 'none'; style-src 'unsafe-inline' data:; font-src data:; img-src data: https://upload.wikimedia.org/favicon.ico; connect-src https://upload.wikimedia.org/favicon.ico; media-src data: 'self'; object-src 'self'; report-uri https://commons.wikimedia.org/w/api.php?reportonly=1&source=image&action=cspreport&format=json&";
+            set resp.http.Reporting-Endpoints = "csp-endpoint="https://commons.wikimedia.org/w/api.php?reportonly=1&source=image&action=cspreport&format=json&"";
+            set resp.http.Content-Security-Policy-Report-Only = "default-src 'none'; style-src 'unsafe-inline' data:; font-src data:; img-src data: https://upload.wikimedia.org/favicon.ico; connect-src https://upload.wikimedia.org/favicon.ico; media-src data: 'self'; object-src 'self'; report-uri https://commons.wikimedia.org/w/api.php?reportonly=1&source=image&action=cspreport&format=json&; report-to csp_endpoint";
             set resp.http.X-Content-Security-Policy-Report-Only = resp.http.Content-Security-Policy-Report-Only;
         } else {
-            set resp.http.Content-Security-Policy-Report-Only = "default-src 'none'; style-src 'unsafe-inline' data:; font-src data:; img-src data: https://upload.wikimedia.org/favicon.ico; connect-src https://upload.wikimedia.org/favicon.ico; media-src data: 'self'; report-uri https://commons.wikimedia.org/w/api.php?reportonly=1&source=image&action=cspreport&format=json&";
+            set resp.http.Reporting-Endpoints = "csp-endpoint="https://commons.wikimedia.org/w/api.php?reportonly=1&source=image&action=cspreport&format=json&"";
+            set resp.http.Content-Security-Policy-Report-Only = "default-src 'none'; style-src 'unsafe-inline' data:; font-src data:; img-src data: https://upload.wikimedia.org/favicon.ico; connect-src https://upload.wikimedia.org/favicon.ico; media-src data: 'self'; report-uri https://commons.wikimedia.org/w/api.php?reportonly=1&source=image&action=cspreport&format=json&; report-to csp_endpoint";
             set resp.http.X-Content-Security-Policy-Report-Only = resp.http.Content-Security-Policy-Report-Only;
-        }
-
-        // Testwiki now in enforce mode
-        if (req.url ~ "^/wikipedia/test") {
-            if ( req.url ~ "(?i)\.pdf$" ) {
-                // PDFs don't like no object-src and sandbox in chrome
-                set resp.http.Content-Security-Policy = "default-src 'none'; style-src 'unsafe-inline' data:; font-src data:; img-src data: https://upload.wikimedia.org/favicon.ico; connect-src https://upload.wikimedia.org/favicon.ico; media-src data: 'self'; object-src 'self'; report-uri https://commons.wikimedia.org/w/api.php?reportonly=0&source=image&action=cspreport&format=json&";
-                set resp.http.X-Content-Security-Policy = "default-src 'none'; style-src 'unsafe-inline' data:; font-src data:; img-src data: https://upload.wikimedia.org/favicon.ico; connect-src https://upload.wikimedia.org/favicon.ico; media-src data: 'self'; object-src 'self'; report-uri https://commons.wikimedia.org/w/api.php?reportonly=0&source=image&action=cspreport&format=json&";
-            } else {
-                set resp.http.Content-Security-Policy = "default-src 'none'; style-src 'unsafe-inline' data:; font-src data:; img-src data: https://upload.wikimedia.org/favicon.ico; connect-src https://upload.wikimedia.org/favicon.ico; media-src data: 'self'; sandbox; report-uri https://commons.wikimedia.org/w/api.php?reportonly=0&source=image&action=cspreport&format=json&";
-                set resp.http.X-Content-Security-Policy = "default-src 'none'; style-src 'unsafe-inline' data:; font-src data:; img-src data: https://upload.wikimedia.org/favicon.ico; connect-src https://upload.wikimedia.org/favicon.ico; media-src data: 'self'; sandbox; report-uri https://commons.wikimedia.org/w/api.php?reportonly=0&source=image&action=cspreport&format=json&";
-            }
         }
     }

Compilation results for cp2044.codfw.wmnet: System changes detected

Catalog differences

Summary

Resources modified

Relevant files