Tagging serviceops to see if they're the correct team to help with this, or please re-direct as necessary.

Hi @Dbrant,

in the mediawiki-config repo there is a path ./docroot/wikipedia.org. For example there is a "spec.yaml" there which you can see at https://wikipedia.org/spec.yaml

There are also different types of auth files for Bing, Google and Apple in there.

So I think you could just upload this as a change into Gerrit and get some reviews and have it deployed with a deployment window.

Ahh excellent! Thanks, @Dzahn
This looks like all we need, and we'll have a patch ready soon.

Change 736042 had a related patch set uploaded (by Dbrant; author: Dbrant):

[operations/mediawiki-config@master] Add Android site association file.

https://gerrit.wikimedia.org/r/736042

Change 736042 merged by jenkins-bot:

[operations/mediawiki-config@master] Add Android site association file.

https://gerrit.wikimedia.org/r/736042

Mentioned in SAL (#wikimedia-operations) [2021-11-03T18:22:16Z] <urbanecm@deploy1002> Synchronized docroot/wikipedia.org/: 2331d061b95ba3fc4de8844008fac93ce18f9063: Add Android site association file (T294776) (duration: 01m 02s)

Mentioned in SAL (#wikimedia-operations) [2021-11-03T18:34:50Z] <urbanecm> Purge https://en.wikipedia.org/.well-known/assetlinks.json, https://www.wikipedia.org/.well-known/assetlinks.json and https://wikipedia.org/.well-known/assetlinks.json (T294776)

@Urbanecm thanks for the help with deployment. Just one follow-up question:
Would it be possible for this file to be served without redirecting to en.wikipedia.org? (i.e. literally from the base domain wikipedia.org/.well-known/assetlinks.json, without a 301 to en.wikipedia.org)

To be clear, it should work OK with the redirect, but would be even better without.

@Dbrant Thanks for asking! That's a very good question, but unfortunately not for me -- the redirect appears to happen at the cache level rather than at the MediaWiki level.

@ssingh As today SRE clinic duty, could you please answer @Dbrant's question above, or help me route it to someone who can answer it? Thanks!

Hi Traffic, the question here is.. how come we get a redirect at the caching level from bare domain to www.wikipedia and from there to en.wikipedia for the new file at:

https://wikipedia.org/.well-known/assetlinks.json

but not for the existing file, for example at:

https://wikipedia.org/spec.yaml

P.S. Actually, I do get the "wikipedia.org" -> "www.wikipedia.org" -> "en.wikipedia.org" in both cases. Same for them. So it's just about all files in the bare document root.

(@Dzahn The spec.yaml file is also redirecting)

Removed traffic again because I actually found it at the apache level, not at caching level after all.

 1 <VirtualHost *:80>
 2 
 3     ServerName wikipedia.org
 4 
 5     # Redirecting from subdirectories of wikipedia.org to subdomains
 6     RewriteEngine On
 7     RewriteRule . - [E=RW_PROTO:%{HTTP:X-Forwarded-Proto}]
 8     RewriteCond %{ENV:RW_PROTO} !=https
 9     RewriteRule . - [E=RW_PROTO:http]
10 
11     RewriteRule ^/([a-z]{2}|meta)/(.*)$ %{ENV:RW_PROTO}://$1.wikipedia.org/wiki/$2 [R=301,L,NE]
12 
13     # Prevent the catch-all redirect below from breaking the apple-app-site-association alias
14     RewriteRule /apple-app-site-association - [L]
15     Alias /apple-app-site-association /srv/mediawiki/docroot/wikipedia.org/apple-app-site-association
16 
17     RewriteRule ^(.*)$ %{ENV:RW_PROTO}://www.wikipedia.org$1 [R=301,L]
18 </VirtualHost>

See above how the comments talk about preventing the redirect for apple-app-site-association. That seems to be the same thing just for Apple instead of Android and they also wanted this. How important is it though? Getting a special rewrite rule into that config we should only do if we really have to.

@Dzahn Thanks for finding that.

The more I look into it, the more important this seems to be for Android 12 compatibility. If we can add a similar rule for this file, that would be ideal, especially if there is already a precedent for the Apple case.
Can you point me to the repo that has this configuration? (assuming this is a patch that we can do ourselves)

@Dbrant This is in the repo operations/puppet in ./modules/mediawiki/templates/apache/sites/wwwportals.conf.erb.

Change 736595 had a related patch set uploaded (by Dbrant; author: Dbrant):

[operations/puppet@production] Create alias for Android site association file.

https://gerrit.wikimedia.org/r/736595

@Dzahn Does this kind of change get merged/deployed in the same way as other config changes? Whoops, nevermind -- I see the special puppet request windows in the deployments.

Change 736595 merged by Dzahn:

[operations/puppet@production] Create alias for Android site association file.

https://gerrit.wikimedia.org/r/736595

https://wikipedia.org/.well-known/assetlinks.json

In T294776#7489343, @Dbrant wrote:

@Dzahn Does this kind of change get merged/deployed in the same way as other config changes? Whoops, nevermind -- I see the special puppet request windows in the deployments.

Yea, but the puppet request window is also better for smaller changes. This one touching apache-config is probably not the best example for that. Either way, it was deployed now.

deployed to prod servers (which refreshes apache on all of them) carefully via:

• disabled puppet on mw*
• re-enabled on canaries, then codfw, then finally eqiad
• tested from both cumin1001 and cumin2001 with httpbb and updated tests (44 assertions vs 43) and it passed all
• after manually re-enabling a couple by hand letting puppet do the rest and _not_ forcing puppet run on all at once, puppet deployed the rest

and Reedy then purged from cache:

19:11 Reedy: echo "https://wikipedia.org/.well-known/assetlinks.json" | mwscript purgeList.php enwiki

This should be resolved now.

 curl https://wikipedia.org/.well-known/assetlinks.json
[{
  "relation": ["delegate_permission/common.handle_all_urls"],
  "target": {
    "namespace": "android_app",
    "package_name": "org.wikipedia",
    "sha256_cert_fingerprints":
    ["F5:40:E9:37:41:9A:1F:E3:08:E3:35:31:35:9C:23:CE:19:DF:D8:4A:66:01:E2:EF:85:C2:17:C8:23:A7:08:7F"]
  }
}]