Steps to replicate the issue (include links if applicable):
- In a test tool, run toolforge build start --ref=b587494830 https://gitlab.wikimedia.org/toolforge-repos/lucaswerkmeister-test && webservice stop && webservice buildservice start --mount=none
- Load the tool and see that the JavaScript loads (the heading should read “This is a test! It is successful!”)
- Run toolforge build start --ref=b587494830 --use-latest-versions https://gitlab.wikimedia.org/toolforge-repos/lucaswerkmeister-test && webservice stop && webservice buildservice start --mount=none
- Load the tool and see that the JavaScript no longer loads (the heading only reads “This is a test!”)
- Firefox reports: Loading module from “https://lucaswerkmeister-test.toolforge.org/index.js” was blocked because of a disallowed MIME type (“”).
- Chromium reports: Failed to load module script: Expected a JavaScript-or-Wasm module script but the server responded with a MIME type of "". Strict MIME type checking is enforced for module scripts per HTML spec.
What happens?:
Without --use-latest-versions, the image is based on Ubuntu 22.04 and includes the media-types package, which ships the /etc/mime.types file that e.g. uWSGI or Gunicorn consult (via mimetypes) to determine the Content-Type response header they should sent. With --use-latest-versions, the package and file are missing and the servers don’t send a Content-Type response header, which makes browsers not load type="module" script tags pointing to scripts without those headers.
I haven’t exhaustively checked all other possible runtimes; I expect most Python servers would use the mimetypes module and be affected, whereas JavaScript tools may be more likely to get it from e.g. the mime npm package and be unaffected.
What should have happened instead?:
The /etc/mime.types file should be included.