alternative deviantart frontend, no javascript. go. http://git.krz.sh/krz/skunky-art.git/atom?h=v1.3.6 2026-07-15T08:17:09+00:00 2026-07-15T08:17:09+00:00 Christian Cleberg hello@cleberg.net 2026-07-15T08:17:09+00:00 urn:sha1:83d9cd0b7a3e0ec6beb5c889102211567a6db03f Two independent faults made every image fail while pages still rendered. config.example.json shipped download-proxy=http://127.0.0.1:8080. Only media fetches go through that proxy — pages reach DeviantArt via devianter on the default transport — so when nothing listens there, images 502 and the rest of the page looks fine. In a scratch container 127.0.0.1 is the container itself, so the default could never work under Docker. Unset it and document that it must stay empty unless an operator really runs a proxy. Host was a package global reassigned by every request, so a concurrent request could overwrite it mid-render and emit URLs on another origin's host and port. The instance's own default-src 'self' CSP then blocked those images. Thread the request's host through skunkyart instead, and take it as an explicit argument in URLBuilder, ParseMedia, ParseDescription, BuildUserPlate and ConvertDeviantArtURLToSkunkyArt. Feeds keep their absolute URLs. Also start RefreshInstances after ExecuteConfig rather than before it: the goroutine read CFG while json.Unmarshal was writing it (a race the detector flags), and its fetch escaped both the throttle and the configured User-Agent. Verified: 300 concurrent requests with distinct Host headers now round-trip their own host (was 1 leak per 300), go test -race is clean, and cache+proxy both enabled serves 200 image/jpeg cold and from cache. 2026-07-15T07:34:41+00:00 Christian Cleberg hello@cleberg.net 2026-07-15T07:34:41+00:00 urn:sha1:bc9c79be7824252f385b9d052595ed8d7460f43f The copyright on /about and in the CLI help credited only lost+skunk and linked to their matrix account. Credit this fork alongside the original, as the X11 license requires retaining the upstream notice, and point the attribution at the upstream repo rather than the stale matrix link. Replace the upstream matrix room link with this fork's issue tracker. 2026-07-15T07:25:20+00:00 Christian Cleberg hello@cleberg.net 2026-07-15T07:25:20+00:00 urn:sha1:d6789522d3dd076f7c98dafa3e7d42df09252093 The remaining golangci-lint findings. These land together because the Url -> URL rename spans util.go, parsers.go and wrapper.go, and splitting it would leave an intermediate commit that does not compile. Download() carried the most serious bug here: try() only prints an error, it does not return, so a failed request fell through to resp.Body.Close() on a nil resp and panicked. Every failure path now returns the zero Downloaded, and callers check Status. ReturnHTTPError guards against the resulting status 0, which would otherwise panic WriteHeader. Requests carry a context with a timeout (noctx), and a download-proxy now routes through ProxiedTransport so it keeps the DA throttle and timeouts. Also: - doc comments on all 48 exported symbols (revive's exported rule, with checkPrivateReceivers, since most of app is exported methods on the unexported skunkyart type), plus package docs in new doc.go files so both the embed and non-embed builds are covered. - ST1003 naming: UrlBuilder -> URLBuilder, id_search -> idSearch, cache_config -> cacheConfig, TXT_RAW -> TxtRaw, mediaUrl -> mediaURL. - explicit json tags on structs that are unmarshaled (musttag); the hyphenated keys already had tags, the rest relied on case-insensitive fallback. Behaviour is unchanged. - modernization: range-over-int, WaitGroup.Go, stale +build lines, interface{} -> any, strings.Builder over string concatenation in a loop. 2026-07-15T07:24:58+00:00 Christian Cleberg hello@cleberg.net 2026-07-15T07:24:58+00:00 urn:sha1:7eb5e5e2230b6fb5b1bed6f0eaa03279aa61555b Correctness and security findings surfaced by golangci-lint, plus two latent panics found alongside them. - router: http.ListenAndServe has no timeouts at all (gosec G114), so a slow client could hold a connection and its handler open indefinitely. Replace it with an explicit http.Server carrying read/write/idle timeouts. - httpclient: InstallDAThrottle asserted http.DefaultTransport was a *http.Transport and would panic outright if anything had already wrapped it -- which is precisely what that function does. Check the assertion and fall back to a fresh transport. Expose ProxiedTransport so a configured download-proxy can inherit the same throttle and timeouts instead of silently bypassing them. - cache: the Sys() assertion to *syscall.Stat_t is only valid on unix and would panic elsewhere; skip rotation instead. Indexing Headers["Content-Type"][0] panics when the header is absent; use Headers.Get. Cache files are written 0600 rather than 0700, as they are never executed. - cli, api: check error returns, and exit rather than nil-dereference a file handle that failed to open. SHA-1 and math/rand keep //nolint:gosec with reasons: they are cache-key hashes and random-artwork picks, not security primitives. 2026-07-15T07:23:59+00:00 Christian Cleberg hello@cleberg.net 2026-07-15T07:23:59+00:00 urn:sha1:40d405f318a109aad5e7de7ad71fedcc04bb0e86 max-size is documented in SETUP.md as megabytes, but the conversion was `*= 1024 ^ 2`. In Go `^` is XOR, not exponentiation, so this multiplied by 1026 rather than 1048576 -- a configured max-size of 200 produced a ~205 KB cap instead of 200 MB, wiping the cache almost immediately. This changes runtime behaviour: the cache will now grow to the size the config actually asks for. 2026-07-15T06:58:41+00:00 Christian Cleberg hello@cleberg.net 2026-07-15T06:54:26+00:00 urn:sha1:b1ad14553277d9d72a5e4b4462a52a2e2d0fdbb1 2026-07-15T01:28:02+00:00 Christian Cleberg hello@cleberg.net 2026-07-15T01:28:02+00:00 urn:sha1:0aff13949a8e9e120a585f00627ef6959f8e0635 Upstream references still pointed at git.macaw.me, which is unmaintained and whose instances.json is a dead link. Repoint them at this repo: - RefreshInstances now fetches instances.json from raw.githubusercontent - source/version links in index.htm, about.htm, and CLI help use the GitHub releases tag URL - SETUP.md/SETUP-RU.md language switch links were Gitea-absolute paths that 404 on GitHub; make them relative - --add-instance message says 'main' branch, matching this repo The fork attribution in README.md is left as-is: it credits upstream rather than pointing at the source. 2026-07-15T01:22:26+00:00 Christian Cleberg hello@cleberg.net 2026-07-15T01:22:26+00:00 urn:sha1:5763dc3cfeadf491d6eda3b6a91623f86396a134 DeviantArt fronts its API with CloudFront + WAF, which bans egress IPs that hit it too hard. devianter issues requests with a bare http.Client, so unbounded concurrent handlers each pulled ~150-200 KB of JSON, which both risked a ban and could exhaust the process under a bot flood. Wrap the default transport to bound rate and concurrency for deviantart.com and add timeouts. Other hosts (wixmp image CDN) pass straight through, so media stays fast, and ProxyFromEnvironment is preserved so HTTPS_PROXY egress still works. 2026-07-15T01:22:14+00:00 Christian Cleberg hello@cleberg.net 2026-07-15T01:22:14+00:00 urn:sha1:8a00f7c55cdbcddcd878c01a79f2db7dc3f080ef Three bugs in Random(): - The retry loop was unbounded. Only the NSFW path incremented attempt, so a run of DeviantArt errors span forever, hammering the API and risking an egress-IP ban. - string(rand.Intn(999)) converts a rune, not a number: string(65) is "A", not "65". Searches were querying garbage. Use strconv.Itoa. - rand.Intn panics on 0, so an empty result set crashed the handler. Skip empty results. The exhausted-retries error now fires when the loop ends rather than falling through to index an empty slice. 2026-07-15T01:22:04+00:00 Christian Cleberg hello@cleberg.net 2026-07-15T01:22:04+00:00 urn:sha1:0fdc45a668d95d603a9013f90392f6bc966c72f9 Repoint the import path from git.macaw.me/skunky/devianter, replacing a placeholder v0.0.0 require that had no go.sum entry and did not resolve. v0.3.1 reorders the last two return values of PerformSearch, Group.Get and Group.Gallery from (..., error, Error) to (..., Error, error); adapt the call sites. The two types differ, so the compiler enforces this.