Repository navigation
Conversation
…11b114123c54e4f91825f) Not an authored commit. This tree was extracted from the build artifact /apps/export-server-private-stg/export-server-standalone.jar on the production host export-anychart-com (68.183.48.137), recovered 2026-09-16. Provenance, from META-INF/maven/export-server/export-server/pom.properties in that JAR: #Thu Oct 25 07:15:02 UTC 2018 version=1.6.0 revision=6d7bdf4eb03cc5e5c8111b114123c54e4f91825f Revision 6d7bdf4e does not exist in this repository; origin has a single branch, master, whose newest logic commit is its parent 4e25583 (2018-10-24). The work below was therefore never pushed. It is reconstructed here from the artifact so the history is not lost with the droplet. Contents: adds the analytics subsystem — analytics/core.clj (/stat, /summary, POST /svgs, backed by hits/domains tables in the export_prod schema), the templates stat.html and summary.selmer, route and wiring changes in core.clj, sharing/core.clj and handlers/web_handlers.clj (every to-* handler gains a request argument and calls analytics/store), and project.clj gains ring/ring-json plus a ClojureScript/Reagent stack with lein-cljsbuild. NOT recovered: src-cljs/, the ClojureScript source behind stat.html. cljsbuild compiles it from a path outside :source-paths, so only build output was packed. The :whitespace build (resources/public/js/main.js, 4.2 MB) survives in the production artifact and is readable; the :advanced build is not reversible. Extraction fidelity was verified independently: the same procedure applied to the public-stg JAR, built from 4e25583 which IS in this repository, produced sources, templates and project.clj byte-identical to the git checkout.
…fe8cfadb62aef67021ee40bc)
Not an authored commit. This tree was extracted from the artifact that is
RUNNING IN PRODUCTION as of 2026-09-16:
/apps/export-server-private-prod/export-server-standalone.jar on
export-anychart-com (68.183.48.137), serving export.anychart.com.
Provenance, from META-INF/maven/export-server/export-server/pom.properties:
#Wed May 15 08:08:16 UTC 2019
version=1.7.0
revision=e49ff254ec29b4c8fe8cfadb62aef67021ee40bc
Revision e49ff254 does not exist in this repository. Until this commit, the only
copy of the source behind the production service was inside that JAR, on a
droplet running Ubuntu 14.04 with no backups (INFRA-466).
Source delta from the parent: exactly one file,
browser/etaoin/svg_to_png.clj. The SVG render path changes from navigating to a
data:text/html;base64 URL wrapping the SVG in an HTML shell, to writing the raw
SVG to File/createTempFile and navigating to file:///tmp/anychart<rand>.svg as a
standalone SVG document. The commented rationale in the code blames driver hangs
on long base64 URLs. Two consequences worth recording:
1. Rendering semantics differ. A standalone SVG document and an SVG embedded
in an HTML body do not scale or position identically, so any rebuild,
parity test or rewrite must target this path, not master's.
2. The temp file is deleted on the success path only (the shutdown branch),
and .deleteOnExit cannot compensate because the hourly restart.sh cron
SIGKILLs the JVM. This is the source of the anychart*.svg litter counted in
INFRA-462 and is the fix site for INFRA-467 -- which currently names
script_to_png.clj, a file production does not execute for this path.
Also included: resources as shipped in the production artifact -- AnyChart
bundle 8.6.0 (master carries 8.14.1), js/inject.js, and the compiled analytics
UI under public/ (main.js :whitespace 4.2 MB, main.min.js :advanced 437 KB,
css/main.css, preloader.gif). project.clj is the real file from
META-INF/leiningen, not a reconstruction.
Dependency availability rechecked 2026-09-16: every declared dependency still
resolves on Clojars/Maven Central. One caveat for byte-identical rebuilds only --
the artifact contains cheshire 5.7.2-SNAPSHOT while project.clj declares 5.8.0,
and that snapshot is 404 today; it was almost certainly a locally installed
build in the 2019 build machine's ~/.m2. A clean rebuild resolves 5.8.0.
Known defects carried in this code, recorded rather than fixed here (a recovery
commit should reproduce production, not diverge from it):
- templates/stat.html interpolates a query parameter into a JS string literal
("{{domain}}") and emits {{init-data|safe}} as unescaped cheshire JSON whose
values derive from attacker-supplied Referer headers. /stat, /summary and
/svgs are 403 on the public vhost and 401 behind export.anychart.prv, so
neither is publicly reachable.
- analytics/core.clj ships with its writer stubbed: (defn store [...] nil).
rkkmkkfx
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Purpose
Recover the deployed export-server 1.7.0 implementation and integrate the current AnyChart 8.14.1 bundle. The deployed source revision (
e49ff254ec29b4c8fe8cfadb62aef67021ee40bc) is unavailable in this repository; the production JAR supplied the application sources, metadata, templates, and compiled resources.Server version remains 1.7.0. Master's 1.6.0 metadata predates the deployed implementation. This PR recovers existing application behavior and updates its embedded chart library; it does not introduce a new server API version.
Recovery includes analytics read endpoints and compiled UI, the already-disabled analytics writer, and the production temporary-file SVG rendering path. Original analytics ClojureScript sources were not embedded in the JAR; compiled JavaScript is preserved unchanged.
Integration
Commit
d5dc819merges master4d3d0b8into recovery965a24f, resolving both conflicts. Compared with the recovered snapshot, onlyresources/js/anychart-bundle.min.jsand its version description inproject.cljchange. Recovered application code and dependencies remain unchanged.The embedded bundle is 8.14.1.1941, byte-identical to both master and the official 8.14.1 CDN artifact. GitHub's latest AnyChart release was v8.14.1 when checked on 2026-09-21. The original production snapshot embeds 8.6.0; exact whole-resource parity applies to historical recovery commit
965a24f, not this updated candidate.Comparison rerun — 2026-09-21
Built with JDK 8 / Leiningen 2.9.10 (
lein uberjar). Compared candidate and original production JAR on the same JRE 8 / Chromium and ChromeDriver 152.0.7977.82 runtime, with bounded live checks.Chart fixtures: bar, line, area, pie, scatter, heatmap, treemap, stock, Gantt, and local GeoJSON map. Test scripts initially contained an incorrect version-property name, a map fixture assumption and an overly strict element-count threshold; corrected fixture checks pass. This does not erase the actual load failures below.
Visible change and remaining failures
Script-generated raster exports without a license now display an AnyChart trial/unlicensed credit. The existing template CSS does not suppress the newer bundle's credit rendering. The plot region is pixel-identical for all ten PNG fixtures after excluding the test's version title and bottom credit strip; full images are not identical. No credit-removal patch was added. Production currently disables script execution, but CLI and installations enabling scripts must account for this change. Licensed rendering was not tested. The analytics summary separately retains its existing AnyChart 7.14.0 CDN dependency.
The rerun is not fully green: candidate 719/720 local load requests succeeded, original 718/720. All three failures are HTTP 400 responses with ChromeDriver
java.net.ConnectException: Connection refusedduring unchanged SVG rendering/driver recycling. SVG inputs bypass the updated bundle. Scratch-file accumulation remains; failed renders leave temporary SVG files. These observations support an existing runtime issue, not a demonstrated bundle regression; a precise race root cause is not established.Both artifacts retain the modern-browser viewport issue (requested 300×200 becomes 300×57). Local fonts differ from production. The script comparison uses a 600×543 viewport for explicit 600×400 chart content as a diagnostic accommodation, not an application fix.
Production JAR SHA-256:
fa26f353076cecb727dbe0aec94c81c449ba4f37ccd123694786fe07f01360e0.Candidate JAR SHA-256:
6e20ccdcd08825e9e0352428f9e682f2450493e13b33802a836bedfbf89fba82.Embedded bundle SHA-256:
535008b4df0f486fe30f81fbb0f3d6057425277e03e64cd675ae9cf5b81c765e.Evidence is retained in the workspace under
docs/plans/2026-09-21-export-server-bundle-comparison.{md,png,zip}. The archive includes raw responses, metrics, logs, scripts, and reproduction instructions; no production database or real credentials.No production deployment, runtime upgrade, Clojure dependency upgrade, or database migration occurred. Live saves, real Twitter/X login/posting, multi-day soak, Firefox, PhantomJS, and analytics pagination interactions were not tested. Independent merge review found no blocking code/metadata issue. Keep this draft for review of the recovered implementation and documented behavior differences.