Chrome won't read CSS/JS from http URLs in a https page

+1 for just copying files to be local to server. Other solutions won't work by the same security check reasons, or more cumbersome and flaky.

Actually, I see even worse situation:

[blocked] The page at https://snapshots.linaro.org/quantal/restricted/integrated-big.little-fastmodels/1 ran insecure content from http://resources/css/ext-all.css.
[blocked] The page at https://snapshots.linaro.org/quantal/restricted/integrated-big.little-fastmodels/1 ran insecure content from http://www.linaro.org/remote/css/init.css.
[blocked] The page at https://snapshots.linaro.org/quantal/restricted/integrated-big.little-fastmodels/1 ran insecure content from http://www.linaro.org/remote/css/remote.css.
[blocked] The page at https://snapshots.linaro.org/quantal/restricted/integrated-big.little-fastmodels/1 ran insecure content from http://www.linaro.org/remote/js/linarofamily.js.
[blocked] The page at https://snapshots.linaro.org/quantal/restricted/integrated-big.little-fastmodels/1 ran insecure content from http://js/jquery-1.7.2.js.
[blocked] The page at https://snapshots.linaro.org/quantal/restricted/integrated-big.little-fastmodels/1 ran insecure content from http://js/jquery-ui-1.8.23.custom.min.js.
[blocked] The page at https://snapshots.linaro.org/quantal/restricted/integrated-big.little-fastmodels/1 ran insecure content from http://css/jquery-ui/jquery-ui-1.8.23.custom.css.
[blocked] The page at https://snapshots.linaro.org/quantal/restricted/integrated-big.little-fastmodels/1 ran insecure content from http://css/linaro.css.

Note things like "http:///css/linaro.css" (I didn't even think it's valid URL). In linaro-license-protection/templates/header.html we have:

href="{% if request.is_secure %}https{% else %}http{% endif %}://{{ request.get_host }}/css/linaro.css"

apparently, that's too complicated and not going to work - SSL is served by frontend web server, if our app is proxied, it won't get any chance to know if it's behind SSL.

href="/css/linaro.css"

should be well enough, and that's first change I'd propose to do.

Ok, it seems that conditional handling like above was done by Stevan:

    revno: 129.2.10
    committer: Stevan Radakovic <email address hidden>
    branch nick: textile-view
    timestamp: Mon 2012-10-15 13:14:42 +0200
    message:
      Fix js and css path issues.
    - <link rel="stylesheet" type="text/css" href="resources/css/ext-all.css" />
    + <link rel="stylesheet" type="text/css" href="{% if request.is_secure %}https{% else %}http{% endif %}://{{ request.get_host }}/resources/css/ext-all.css" />

So, I'll let him to comment.

Yes, those lines where introduced by me when we were adding the jQuery and jQuery-UI libraries.
I will try fixing this by simply putting the path as you suggested.
One thing that concerns me Paul is that I cannot seem to find this 'ext-all.css' file nowhere in our code base (not even with bzr log), and it's not present on the server (production nor staging) in any familiar paths.
So I don't think it will be fixed simply by changing path (because for that one there is an error in both firefox and chrome, the file simply does not exist)... Any ideas regarding this?

Indeed, ext-all.css is neither in linaro-license-protection bzr repo, nor at http://snapshots.linaro.org/resources/css/ext-all.css . So, I guess few things should be done for this bug:

1. Remove refs to stale css files.
2. Reference other css/js with schama/host-less absolute paths.
3. Mirror www.linaro.org's css into linaro-license-protection bzr repo and install them locally on snapshots.linaro.org. (Preferrably, write simple script to automate updating of mirrored files - just couple of wget's).

Note that this will soon apply to releases.linaro.org as well. As for CSS, we can also provide a proxy request that will read the file directly from linaro.org (with good e-tag and cache headers, it should not cause any problems performance-wise).

Once this bug is fixed, please comment on https://rt.linaro.org/Ticket/Display.html?id=800 to enable https redirect on releases.linaro.org.