Android Build Frontend should not be running with Django's debug=True setting

[Paul Sokolovsky]

<zyga> pfalcon, OMG you run with debug=True?
<zyga> pfalcon, that leaks memory!
<zyga> https://android-build.linaro.org/builds/~asac/
<zyga> pfalcon, ^^
<zyga> pfalcon, IIRC it could also be used to leak session IDs, I'd recommend turning it off if you can

[Paul Sokolovsky (pfalcon)]

Well, that's kinda how we had it all the time, because android build frontend never actually left "beta" state (there're too many issues known, even though we removed "BETA" moniker from logo some time ago). Having debug printout was also useful at times, but I guess Zygmunt is right and we should disable it by default.

[Paul Sokolovsky (pfalcon)]

For maint. team: changes to the build frontend need to be explicitly deployed, see https://wiki.linaro.org/Platform/Android/LinaroAndroidBuildService#Production_Deployment_Details . Ping me if any q's.

[Milo Casagrande (milo)]

I was taking a look at it, just on question: where is the code of the frontend? Do we have a branch somewhere? From the wiki page it is not that clear where the actual code is (there is /home/build-system-frontend that I guess has everything in there).

Shouldn't we have a branch somewhere?

[Paul Sokolovsky (pfalcon)]

Definitely, and all our branches are (should be/would be) available from https://code.launchpad.net/~linaro-infrastructure/ .

(Just as an extra hint, that shows branches owned by our group directly, so some branches may be missing. But there're helpful links at the bottom to the branches owned by groups we're members of.)

[Milo Casagrande (milo)]

I must have been tired yesterday to totally missing it out, and I looked even twice.
Anyway, proposed branch with the trivia fix.

[Milo Casagrande (milo)]

New frontend has been deployed, we might have to work a little bit on the error pages though.

[Paul Sokolovsky (pfalcon)]

Yup, now trying the test URL above (https://android-build.linaro.org/builds/~asac/) gives 500. I doubt that much better than providing a nice verbose error page, even if it potentially can leak something (to folks who already entrusted with access I guess).

So, I'd reopen this bug for further investigation and filing another as needed.

[Paul Sokolovsky (pfalcon)]

Opened lp:1020010 for unsolicited 500 errors everywhere. Closing this.