diff --git a/ci/build/update-vscode.sh b/ci/build/update-vscode.sh
index bc4eddbe0..32b7fc1a2 100755
--- a/ci/build/update-vscode.sh
+++ b/ci/build/update-vscode.sh
@@ -4,7 +4,7 @@ set -Eeuo pipefail
function unapply_patches() {
local -i exit_code=0
- quiet quilt pop -af || exit_code=$?
+ quiet quilt pop -af 2>&1 || exit_code=$?
case $exit_code in
# Sucessfully unapplied.
0) ;;
@@ -15,6 +15,19 @@ function unapply_patches() {
esac
}
+function apply_patches() {
+ local -i exit_code=0
+ quiet quilt push -a 2>&1 || exit_code=$?
+ case $exit_code in
+ # Sucessfully applied.
+ 0) ;;
+ # No more patches to apply.
+ 2) ;;
+ # Some error.
+ *) return $exit_code ;;
+ esac
+}
+
function update_vscode() {
pushd lib/vscode
if ! git checkout 2>&1 "$target_vscode_version" ; then
@@ -28,8 +41,8 @@ function update_vscode() {
function refresh_patches() {
local -i exit_code=0
- while quiet quilt push ; ! (( exit_code=$? )) ; do
- quilt refresh
+ while quiet quilt push 2>&1 ; ! (( exit_code=$? )) ; do
+ quilt refresh 2>&1
done
case $exit_code in
# No more patches to apply.
@@ -56,50 +69,41 @@ function get-webview-script-hash() {
local html
html=$(<"$1")
local start_tag='"
html=${html##*"$start_tag"}
html=${html%%"$end_tag"*}
echo -n "$html" | openssl sha256 -binary | openssl base64
}
+function delete_csp() {
+ quilt delete csp-hashes.diff
+}
+
function update_csp() {
- local current
- current=$(quilt top 2>/dev/null || echo "")
- local patch_action=""
- echo "Currently at ${current:-base}"
- if [[ $current != */webview.diff ]] ; then
- echo "Moving to patches/webview.diff..."
- local -i exit_code=0
- if quilt applied 2>/dev/null | grep --quiet webview.diff ; then
- quiet quilt pop webview || exit_code=$?
- patch_action=pop
- else
- quiet quilt push webview || exit_code=$?
- patch_action=push
- fi
- case $exit_code in
- # Successfully moved.
- 0) ;;
- # Some error.
- *) return $exit_code ;;
- esac
- fi
+ apply_patches
+
+ local files=(
+ ./lib/vscode/src/vs/workbench/contrib/webview/browser/pre/index.html
+ ./lib/vscode/src/vs/workbench/services/extensions/worker/webWorkerExtensionHostIframe.html
+ )
+
+ quilt new csp-hashes.diff
+
+ local file
+ for file in "${files[@]}" ; do
+ quilt add "$file"
+
+ local hash
+ hash=$(get-webview-script-hash "$file")
+ echo "Calculated hash as $hash"
+ # Use octothorpe as a delimiter since the hash may contain a slash.
+ sed -i.bak "s#'sha256-[^']\+'#'sha256-$hash'#" "$file"
+ done
- local file=lib/vscode/src/vs/workbench/contrib/webview/browser/pre/index.html
- local hash
- hash=$(get-webview-script-hash "$file")
- echo "Calculated hash as $hash"
- # Use octothorpe as a delimiter since the hash may contain a slash.
- sed -i.bak "s#script-src 'sha256-[^']\+'#script-src 'sha256-$hash'#" "$file"
quilt refresh
-
- if [[ $patch_action != "" ]] ; then
- echo "Moving back to ${current:-base}..."
- case $patch_action in
- pop) quiet quilt push "$current" ;;
- push) quiet quilt pop "${current:--a}" ;;
- esac
- fi
}
function add_changelog() {
@@ -120,6 +124,9 @@ function main() {
declare -a steps
+ # Hashes are always regenerated to avoid having to resolve conflicts..
+ steps+=("Revert CSP hashes" "delete_csp")
+
# If version is not set, assume we are already at the target version and the
# user is just trying to resolve conflics.
local target_vscode_version
@@ -141,7 +148,7 @@ function main() {
steps+=(
"Update Node version" "update_node"
- "Update CSP webview hash" "update_csp"
+ "Regenerate CSP hashes" "update_csp"
"Add changelog note" "add_changelog"
)
diff --git a/ci/lib.sh b/ci/lib.sh
index df38a9552..41b75d65c 100755
--- a/ci/lib.sh
+++ b/ci/lib.sh
@@ -85,18 +85,20 @@ run-steps() {
while (( $# )) ; do
local name=$1 ; shift
local fn=$1 ; shift
+ echo "$name..."
# Only run if an earlier step has not failed.
+ # For all failed steps, write out an empty checkbox.
if [[ $failed == 0 ]] ; then
- echo "$name..."
if $fn | indent ; then
echo "- [X] $name" >> .cache/checklist
else
((failed++))
+ echo "- [-] $name" >> .cache/checklist
+ echo "Failed" | indent
fi
- fi
- # For all failed steps, write out an empty checkbox.
- if [[ $failed != 0 ]] ; then
+ else
echo "- [ ] $name" >> .cache/checklist
+ echo "Skipped" | indent
fi
done
if [[ $failed != 0 ]] ; then
diff --git a/patches/csp-hashes.diff b/patches/csp-hashes.diff
new file mode 100644
index 000000000..6435caa92
--- /dev/null
+++ b/patches/csp-hashes.diff
@@ -0,0 +1,26 @@
+Index: code-server/lib/vscode/src/vs/workbench/contrib/webview/browser/pre/index.html
+===================================================================
+--- code-server.orig/lib/vscode/src/vs/workbench/contrib/webview/browser/pre/index.html
++++ code-server/lib/vscode/src/vs/workbench/contrib/webview/browser/pre/index.html
+@@ -5,7 +5,7 @@
+
+
+
++ content="default-src 'none'; script-src 'sha256-A6/szVNdTzyi4hDa+9OLbzS8tSd2iUV4CqimLNWex2Y=' 'self'; frame-src 'self'; style-src 'unsafe-inline';">
+
+
+
+
+
diff --git a/patches/series b/patches/series
index 6f438da31..5b548e390 100644
--- a/patches/series
+++ b/patches/series
@@ -24,3 +24,4 @@ trusted-domains.diff
signature-verification.diff
copilot.diff
app-name.diff
+csp-hashes.diff
diff --git a/patches/webview.diff b/patches/webview.diff
index fd5349d73..24ffef3dc 100644
--- a/patches/webview.diff
+++ b/patches/webview.diff
@@ -3,9 +3,6 @@ Serve webviews from the same origin
Normally webviews are served from vscode-webview.net but we would rather them be
self-hosted.
-When doing this CSP will block resources (for example when viewing images) so
-add 'self' to the CSP to fix that.
-
Additionally the service worker defaults to handling *all* requests made to the
current host but when self-hosting the webview this will end up including the
webview HTML itself which means these requests will fail since the communication
@@ -20,16 +17,6 @@ webview host is separate by default but we serve on the same host).
To test, open a few types of webviews (images, markdown, extension details, etc).
-Make sure to update the hash. To do so:
-1. run code-server
-2. open any webview (i.e. preview Markdown)
-3. see error in console and copy hash
-
-That will test the hash change in pre/index.html
-
-Double-check the console to make sure there are no console errors for the webWorkerExtensionHostIframe
-which also requires a hash change.
-
parentOriginHash changes
This fixes webviews from not working properly due to a change upstream.
@@ -66,15 +53,6 @@ Index: code-server/lib/vscode/src/vs/workbench/contrib/webview/browser/pre/index
===================================================================
--- code-server.orig/lib/vscode/src/vs/workbench/contrib/webview/browser/pre/index.html
+++ code-server/lib/vscode/src/vs/workbench/contrib/webview/browser/pre/index.html
-@@ -5,7 +5,7 @@
-
-
-
-+ content="default-src 'none'; script-src 'sha256-A6/szVNdTzyi4hDa+9OLbzS8tSd2iUV4CqimLNWex2Y=' 'self'; frame-src 'self'; style-src 'unsafe-inline';">
-
-
-
-
-
@@ -25,6 +25,13 @@
// validation not requested
return start();