Merge branch 'master' into twitter-card-image

Ian Lewis · web-flow · commit dba155b81017 · 2019-11-19T15:43:23.000-08:00
diff --git a/Makefile b/Makefile
@@ -14,7 +14,7 @@ APP_TARGET = $(patsubst cmd/gvisor-website/%,public/%,$(APP_SOURCE))
 default: website
 .PHONY: default
 
-website: all-upstream app public/static
+website: all-upstream app static-production
 .PHONY: website
 
 app: $(APP_TARGET)
@@ -44,8 +44,13 @@ content/docs/community/sigs: upstream/community $(wildcard upstream/community/si
 $(APP_TARGET): public $(APP_SOURCE)
 	cp -a cmd/gvisor-website/$(patsubst public/%,%,$@) public/
 
-public/static: compatibility-docs node_modules config.toml $(shell find archetypes assets content themes -type f | sed 's/ /\\ /g')
+static-production: compatibility-docs node_modules config.toml $(shell find archetypes assets content themes -type f | sed 's/ /\\ /g')
 	HUGO_ENV="production" $(HUGO)
+.PHONY: static-production
+
+static-staging: compatibility-docs node_modules config.toml $(shell find archetypes assets content themes -type f | sed 's/ /\\ /g')                           
+	$(HUGO) -b  "https://staging-$(shell git branch | grep \* | cut -d ' ' -f2)-dot-gvisor-website.appspot.com"
+.PHONY: static-staging
 
 node_modules: package.json package-lock.json
 	# Use npm ci because npm install will update the package-lock.json.
@@ -77,10 +82,17 @@ server: website
 .PHONY: server
 
 # Deploy the website to App Engine.
-deploy: $(APP_TARGET)
+deploy: website
 	cd public && $(GCLOUD) app deploy
 .PHONY: deploy
 
+# Stage the website to App Engine at a version based on the git branch name.
+stage: all-upstream app static-staging
+	# Disallow indexing staged content.
+	printf "User-agent: *\nDisallow: /" > public/static/robots.txt
+	cd public && $(GCLOUD) app deploy -v staging-$(shell git branch | grep \* | cut -d ' ' -f2) --no-promote
+.PHONY: stage
+
 # CI related Commmands
 ##############################################################################
 
diff --git a/cmd/gvisor-website/app.yaml b/cmd/gvisor-website/app.yaml
@@ -12,7 +12,7 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-runtime: go111
+runtime: go112
 
 handlers:
   - url: /.*
@@ -21,4 +21,3 @@ handlers:
   - url: /rebuild
     secure: always
     script: auto
-    login: admin
diff --git a/cmd/gvisor-website/main.go b/cmd/gvisor-website/main.go
@@ -71,6 +71,20 @@ var (
 	goGetHTML5  = `<!doctype html><html><head><meta charset=utf-8>` + goGetHeader + `<title>Go-get</title></head><body></html>`
 )
 
+// cronHandler wraps an http.Handler to check that the request is from the App
+// Engine Cron service.
+// See: https://cloud.google.com/appengine/docs/standard/go112/scheduling-jobs-with-cron-yaml#validating_cron_requests
+func cronHandler(h http.Handler) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.Header.Get("X-Appengine-Cron") != "true" {
+			http.NotFound(w, r)
+			return
+		}
+		// Fallthrough.
+		h.ServeHTTP(w, r)
+	})
+}
+
 // wrappedHandler wraps an http.Handler.
 //
 // If the query parameters include go-get=1, then we redirect to a single
@@ -174,7 +188,7 @@ func registerRebuild(mux *http.ServeMux) {
 		mux = http.DefaultServeMux
 	}
 
-	mux.Handle("/rebuild", wrappedHandler(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+	mux.Handle("/rebuild", cronHandler(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		ctx := context.Background()
 		credentials, err := google.FindDefaultCredentials(ctx, cloudbuild.CloudPlatformScope)
 		if err != nil {
diff --git a/content/blog/1_security_basics/figure3.png b/content/blog/1_security_basics/figure3.png
