Page MenuHomePhabricator

Build service tools built with --use-latest-versions are missing /etc/mime.types
Open, MediumPublicBUG REPORT

Description

Steps to replicate the issue (include links if applicable):

  • In a test tool, run toolforge build start --ref=b587494830 https://gitlab.wikimedia.org/toolforge-repos/lucaswerkmeister-test && webservice stop && webservice buildservice start --mount=none
  • Load the tool and see that the JavaScript loads (the heading should read “This is a test! It is successful!”)
  • Run toolforge build start --ref=b587494830 --use-latest-versions https://gitlab.wikimedia.org/toolforge-repos/lucaswerkmeister-test && webservice stop && webservice buildservice start --mount=none
  • Load the tool and see that the JavaScript no longer loads (the heading only reads “This is a test!”)
    • Firefox reports: Loading module from “https://lucaswerkmeister-test.toolforge.org/index.js” was blocked because of a disallowed MIME type (“”).
    • Chromium reports: Failed to load module script: Expected a JavaScript-or-Wasm module script but the server responded with a MIME type of "". Strict MIME type checking is enforced for module scripts per HTML spec.

What happens?:
Without --use-latest-versions, the image is based on Ubuntu 22.04 and includes the media-types package, which ships the /etc/mime.types file that e.g. uWSGI or Gunicorn consult (via mimetypes) to determine the Content-Type response header they should sent. With --use-latest-versions, the package and file are missing and the servers don’t send a Content-Type response header, which makes browsers not load type="module" script tags pointing to scripts without those headers.

I haven’t exhaustively checked all other possible runtimes; I expect most Python servers would use the mimetypes module and be affected, whereas JavaScript tools may be more likely to get it from e.g. the mime npm package and be unaffected.

What should have happened instead?:
The /etc/mime.types file should be included.

Upstream issue: heroku/cnb-builder-images#794

Event Timeline

Restricted Application added a subscriber: Aklapper. · View Herald Transcript

In Tool-wdactle, I’ve worked around this by shipping my own mime.types file and configuring it in uwsgi.ini. But this seems pretty brittle (I’ll presumably have to remember to update mime.types if I want to add e.g. an SVG file or a favicon.ico) and also just cumbersome.

bd808 subscribed.

Tagging as Upstream because we do not build these base images locally.

Any volunteers for telling upstream about the issue? I can try to do it tomorrow, but I don’t know much about the build service infrastructure, so I might report it in the wrong place.

So far I’ve managed to reproduce working and broken container images (based on testing locally) with pack-cli build --builder tools-harbor.wmcloud.org/toolforge/heroku-builder:22 myimage and pack-cli build --builder tools-harbor.wmcloud.org/toolforge/heroku-builder:24_0.20.7 myimage respectively (run the image with docker run --rm -e PORT=8000 -p 8000:8000 myimage and then curl -I http://localhost:8000/index.js), though I’m not convinced upstream would accept that issue report given that it’s still using a Toolforge builder (by the looks of it).

Okay, it’s also reproducible with the upstream builders, pack-cli build --builder docker.io/heroku/builder:22 myimage and pack-cli build --builder docker.io/heroku/builder:24 myimage respectively.

fgiunchedi triaged this task as Medium priority.Sep 1 2025, 2:32 PM

You can install the media-types package using project.toml and then point uwsgi/gunicorn at it (it will exist under /layers rather than the root file system).

Sometimes the dependency resolution is wrong (it thinks the package is there, so skips it), that can be forced in the configuration as required (see https://github.com/cluebotng/external-redis/blob/main/project.toml for an example).

Is project.toml something all tools can use? I couldn’t find any documentation about it on Wikitech. (That repo looks like it’s meant to be deployed as a separate continuous job, not as a webservice?)

Anyway, given that upstream already merged a fix and seems to be releasing new image versions reasonably often, I’m fine with just keeping my current workaround for a couple more weeks.

Is project.toml something all tools can use? I couldn’t find any documentation about it on Wikitech. (That repo looks like it’s meant to be deployed as a separate continuous job, not as a webservice?)

project.toml is the --use-latest-versions replacement for an Aptfile to configure the apt buildpack. T394466: [build-service] remove legacy fagiani/apt 0.2.5 builder from `--use-latest-versions` stack

Thanks, that’s good to know (⇒ T403509). I take it documentation will appear once this version of the build service moves out of the --use-latest-versions flag, then :)

Thanks, that’s good to know (⇒ T403509). I take it documentation will appear once this version of the build service moves out of the --use-latest-versions flag, then :)

If you use Aptfile you will get a deprecation warning in the logs, which eventually leads you to the upstream docs.