{"id":19204666,"url":"https://github.com/openttd/survey-web","last_synced_at":"2025-10-17T22:10:59.406Z","repository":{"id":161760730,"uuid":"636394458","full_name":"OpenTTD/survey-web","owner":"OpenTTD","description":"Results and information about OpenTTD's automated opt-in survey","archived":false,"fork":false,"pushed_at":"2025-05-12T07:18:38.000Z","size":22362,"stargazers_count":1,"open_issues_count":0,"forks_count":5,"subscribers_count":6,"default_branch":"main","last_synced_at":"2025-05-12T08:41:07.193Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":"","language":"HTML","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"gpl-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/OpenTTD.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null}},"created_at":"2023-05-04T18:49:18.000Z","updated_at":"2025-05-12T07:18:42.000Z","dependencies_parsed_at":null,"dependency_job_id":"bdab3d35-dde2-4f82-a752-7cd5cb3d746c","html_url":"https://github.com/OpenTTD/survey-web","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/OpenTTD%2Fsurvey-web","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/OpenTTD%2Fsurvey-web/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/OpenTTD%2Fsurvey-web/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/OpenTTD%2Fsurvey-web/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/OpenTTD","download_url":"https://codeload.github.com/OpenTTD/survey-web/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":253773920,"owners_count":21962195,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-11-09T13:09:19.840Z","updated_at":"2025-10-17T22:10:54.360Z","avatar_url":"https://github.com/OpenTTD.png","language":"HTML","funding_links":[],"categories":[],"sub_categories":[],"readme":"# OpenTTD's Survey website\n\n[![GitHub License](https://img.shields.io/github/license/OpenTTD/survey-web)](https://github.com/OpenTTD/survey-web/blob/main/LICENSE)\n\nThis is the [website](https://survey.openttd.org) to show the results of the survey analysis and the information and privacy statement of the participation.\n\nThis is a [Jekyll](https://jekyllrb.com/) website, and is served by nginx as a static site.\n\n## Development\n\n### Survey results\n\nTo summarize survey results, the Python application `analysis` processes a bundle of JSONs and outputs another JSON with the summary.\n\nTo run it:\n- `git clone https://github.com/OpenTTD/BaNaNaS` to get the BaNaNaS dataset (needed to resolve NewGRFs).\n- Create a Python virtual env run `pip install -r requirements.txt`.\n- `python3 -m analysis \u003ctar-xz bundle files\u003e` to run the analysis.\n\n### Running a local server\n\nIf you do not want to run a server, but just build the current site, replace `serve` with `build` in the examples below.\n\nUnder `_site` Jekyll will put the compiled result in both `serve` and `build`.\n\n- Follow [jekyll installation](https://jekyllrb.com/docs/installation/)\n- Run `bundle install`\n- Run `JEKYLL_ENV=production jekyll serve`\n\n### Workers\n\nThe survey makes use of a Cloudflare worker to process the survey results and to hand out new survey-keys.\n\n- Install [wrangler](https://developers.cloudflare.com/workers/wrangler/install-and-update/)\n- Navigate into `workers` folder\n- Run `npm install`\n- Run `npx wrangler dev --local src/index.js`\n\n## Survey keys\n\nSecurity in Open Source is difficult, as all code is open for everyone to read, and everyone can compile their own binary.\nThis is especially an issue if the backend wants to trust information received from a client.\n\nThere is no waterproof method, but the survey makes use of a key to somewhat know the survey result was generated by a trusted client.\nMake no mistake: it is trivial for anyone with ill intentions to retrieve the survey key from an official binary, and reuse it to submit fraudulent survey results.\nThere are other mitigations in place to decrease the impact of this.\n\nMostly, the survey key is used to know when the survey result was created by, for example, a development build.\nThese are very likely to have no key at all.\n\nThat all said, survey keys are simply [JWT](https://jwt.io)s, signed with HS256.\nThis signature is used to validate that a survey result is, most likely, send by a trusted client.\n\n### Getting a survey key\n\nWhen an official binary is built, the GitHub workflow requests a new survey key.\nThis is done by sending the OpenTTD version together with a signature of that request (based on RSA private/public key).\n\nThe public key of this RSA is under `workers/src/public_keys/`.\nThe private key is, of course, a secret within the GitHub workflow of the project itself.\n\nBased on this, the worker can validate that the request is valid, and create a survey key based on the request.\nThis is then used by the GitHub workflow to embed in the binaries.\n\n### Patch-pack support\n\nThe survey fully supports patch-packs, including the ability for them to get a survey key.\n\nFirst, an RSA private/public key is needed.\nThis can be generated in various of ways, but for example via `openssl`:\n\n- Private key: `openssl genrsa -out privatekey.pem 2048`\n- Public key (based on the private key above): `openssl rsa -in privatekey.pem -outform PEM -pubout -out publickey.pem`\n\nNow the public key (without the lines starting with `----`) needs to be added under `workers/src/public_keys/` and `workers/src/public_keys/index.js` needs to be adjusted to import the new key.\nThe name of the file under `public_keys/` is important, as this is part of the URL to retrieve a new survey key.\nRequests to this URL have to be signed with the private key of which the public key is in this repository.\n\nMake a Pull Request out of this change, and point to where your patch-pack can be found etc.\n\nNext, the contents of the private key file (`privatekey.pem`) needs to be added as the `SURVEY_SIGNING_KEY` secret to the GitHub Actions of your repository.\nNow for the last part, add the `SURVEY_TYPE` variable to the GitHub Actions of your repository matching the name of the file above.\nThe patch-pack can now safely create new survey keys.\nSee OpenTTD's workflow (`release-source.yml`) for more details exactly how.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fopenttd%2Fsurvey-web","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fopenttd%2Fsurvey-web","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fopenttd%2Fsurvey-web/lists"}