alternative deviantart frontend, no javascript. go. http://git.krz.sh/krz/skunky-art.git/atom?h=v1.3.5 2026-07-15T16:00:25+00:00 2026-07-15T16:00:25+00:00 Christian Cleberg hello@cleberg.net 2026-07-15T16:00:25+00:00 urn:sha1:b31b5971d8744bf94ef0d30f2be0e17c08b93988 The viewport directives were separated with a semicolon, which browsers reject: "';' is not a valid key-value pair separator". Drop the duplicated trailing user-scalable directive that the semicolon introduced. 2026-07-15T08:17:09+00:00 Christian Cleberg hello@cleberg.net 2026-07-15T08:17:09+00:00 urn:sha1:83d9cd0b7a3e0ec6beb5c889102211567a6db03f Two independent faults made every image fail while pages still rendered. config.example.json shipped download-proxy=http://127.0.0.1:8080. Only media fetches go through that proxy — pages reach DeviantArt via devianter on the default transport — so when nothing listens there, images 502 and the rest of the page looks fine. In a scratch container 127.0.0.1 is the container itself, so the default could never work under Docker. Unset it and document that it must stay empty unless an operator really runs a proxy. Host was a package global reassigned by every request, so a concurrent request could overwrite it mid-render and emit URLs on another origin's host and port. The instance's own default-src 'self' CSP then blocked those images. Thread the request's host through skunkyart instead, and take it as an explicit argument in URLBuilder, ParseMedia, ParseDescription, BuildUserPlate and ConvertDeviantArtURLToSkunkyArt. Feeds keep their absolute URLs. Also start RefreshInstances after ExecuteConfig rather than before it: the goroutine read CFG while json.Unmarshal was writing it (a race the detector flags), and its fetch escaped both the throttle and the configured User-Agent. Verified: 300 concurrent requests with distinct Host headers now round-trip their own host (was 1 leak per 300), go test -race is clean, and cache+proxy both enabled serves 200 image/jpeg cold and from cache. 2026-07-15T07:55:52+00:00 Christian Cleberg hello@cleberg.net 2026-07-15T07:55:52+00:00 urn:sha1:8d08f343c930f556c6ab016be9d00b23f1e516e3 Build and push linux/amd64 + linux/arm64 images to ghcr.io/zerolabsco/skunky-art on every v* tag, with a signed provenance attestation. The Dockerfile cross-compiles from $BUILDPLATFORM, so the arm64 image builds without QEMU emulation. Default both compose examples to the published image and keep `build: .` commented out for building from a checkout, and extend dependabot to the github-actions and docker ecosystems. 2026-07-15T07:49:48+00:00 Christian Cleberg hello@cleberg.net 2026-07-15T07:49:48+00:00 urn:sha1:47bfe56e728d046fc8fb78b784efe6926f08ff9e The published entry for zerolabs.sh claimed proxifying was off while the instance runs with proxy enabled, so /about advertised the opposite of what the instance does. The instance list is fetched from main at runtime, so this corrects the live about page without a rebuild. Also point the instances.json link at skunky-art/main, which is what the app actually fetches, rather than the old SkunkyArt/dev path. 2026-07-15T07:44:24+00:00 Christian Cleberg hello@cleberg.net 2026-07-15T07:44:24+00:00 urn:sha1:59359fdda9db92d95aa3a2819e87a61d63f560fd go.mod requires go 1.25.0, but the Dockerfile still pinned the builder to 1.18, which cannot parse a three-part version string and failed with "invalid go version '1.25.0': must match format 1.23". Track the 1.25 tag rather than a patch release so the builder does not drift out of date again. 2026-07-15T07:34:41+00:00 Christian Cleberg hello@cleberg.net 2026-07-15T07:34:41+00:00 urn:sha1:bc9c79be7824252f385b9d052595ed8d7460f43f The copyright on /about and in the CLI help credited only lost+skunk and linked to their matrix account. Credit this fork alongside the original, as the X11 license requires retaining the upstream notice, and point the attribution at the upstream repo rather than the stale matrix link. Replace the upstream matrix room link with this fork's issue tracker. 2026-07-15T07:25:20+00:00 Christian Cleberg hello@cleberg.net 2026-07-15T07:25:20+00:00 urn:sha1:d6789522d3dd076f7c98dafa3e7d42df09252093 The remaining golangci-lint findings. These land together because the Url -> URL rename spans util.go, parsers.go and wrapper.go, and splitting it would leave an intermediate commit that does not compile. Download() carried the most serious bug here: try() only prints an error, it does not return, so a failed request fell through to resp.Body.Close() on a nil resp and panicked. Every failure path now returns the zero Downloaded, and callers check Status. ReturnHTTPError guards against the resulting status 0, which would otherwise panic WriteHeader. Requests carry a context with a timeout (noctx), and a download-proxy now routes through ProxiedTransport so it keeps the DA throttle and timeouts. Also: - doc comments on all 48 exported symbols (revive's exported rule, with checkPrivateReceivers, since most of app is exported methods on the unexported skunkyart type), plus package docs in new doc.go files so both the embed and non-embed builds are covered. - ST1003 naming: UrlBuilder -> URLBuilder, id_search -> idSearch, cache_config -> cacheConfig, TXT_RAW -> TxtRaw, mediaUrl -> mediaURL. - explicit json tags on structs that are unmarshaled (musttag); the hyphenated keys already had tags, the rest relied on case-insensitive fallback. Behaviour is unchanged. - modernization: range-over-int, WaitGroup.Go, stale +build lines, interface{} -> any, strings.Builder over string concatenation in a loop. 2026-07-15T07:24:58+00:00 Christian Cleberg hello@cleberg.net 2026-07-15T07:24:58+00:00 urn:sha1:7eb5e5e2230b6fb5b1bed6f0eaa03279aa61555b Correctness and security findings surfaced by golangci-lint, plus two latent panics found alongside them. - router: http.ListenAndServe has no timeouts at all (gosec G114), so a slow client could hold a connection and its handler open indefinitely. Replace it with an explicit http.Server carrying read/write/idle timeouts. - httpclient: InstallDAThrottle asserted http.DefaultTransport was a *http.Transport and would panic outright if anything had already wrapped it -- which is precisely what that function does. Check the assertion and fall back to a fresh transport. Expose ProxiedTransport so a configured download-proxy can inherit the same throttle and timeouts instead of silently bypassing them. - cache: the Sys() assertion to *syscall.Stat_t is only valid on unix and would panic elsewhere; skip rotation instead. Indexing Headers["Content-Type"][0] panics when the header is absent; use Headers.Get. Cache files are written 0600 rather than 0700, as they are never executed. - cli, api: check error returns, and exit rather than nil-dereference a file handle that failed to open. SHA-1 and math/rand keep //nolint:gosec with reasons: they are cache-key hashes and random-artwork picks, not security primitives. 2026-07-15T07:23:59+00:00 Christian Cleberg hello@cleberg.net 2026-07-15T07:23:59+00:00 urn:sha1:40d405f318a109aad5e7de7ad71fedcc04bb0e86 max-size is documented in SETUP.md as megabytes, but the conversion was `*= 1024 ^ 2`. In Go `^` is XOR, not exponentiation, so this multiplied by 1026 rather than 1048576 -- a configured max-size of 200 produced a ~205 KB cap instead of 200 MB, wiping the cache almost immediately. This changes runtime behaviour: the cache will now grow to the size the config actually asks for. 2026-07-15T07:23:40+00:00 Christian Cleberg hello@cleberg.net 2026-07-15T07:23:40+00:00 urn:sha1:672ff7f44b0061e179fb33c16418738d6455a4e9 Enables the standard linters plus revive's exported rule, a set of correctness/security linters (bodyclose, noctx, gosec, forcetypeassert, canonicalheader, musttag, predeclared, exhaustive), modernization linters, and staticcheck's full check set including the doc-comment and naming checks that are off by default. The idiom-fighting linters stay off: varnamelen objects to short names that are idiomatic Go, exhaustruct demands every field be initialized, gochecknoglobals flags CFG/Host which are deliberate, and tagliatelle would rename JSON config keys and break existing instances' configs.