Content Security Policy for project websites - Apache Infrastructure Website

<!doctype html> <html class="no-js" lang="en" dir="ltr"> <head> <meta charset="utf-8"> <meta http-equiv="x-ua-compatible" content="ie=edge"> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <title>Content Security Policy for project websites - Apache Infrastructure Website</title> <link href="/css/bootstrap.min.css" rel="stylesheet"> <link href="/css/fontawesome.all.min.css" rel="stylesheet"> <link href="/css/headerlink.css" rel="stylesheet"> <script src="/highlight/highlight.min.js"></script>  <link href="/_pagefind/pagefind-ui.css" rel="stylesheet"> <script src="/_pagefind/pagefind-ui.js" type="text/javascript"></script> <script> window.addEventListener('DOMContentLoaded', (event) => { new PagefindUI({ element: "#pagefind-search" }); }); var pageTitle = ''; if(pageTitle === '404'){ window.addEventListener('DOMContentLoaded', (event) => { new PagefindUI({ element: "#page-404-search" }); }); } </script>  <style type="text/css"> .search-form { right: 0; left: initial !important; min-width: 25vw; max-width: 90vw; max-height: calc(95vh - 100px); overflow: auto; margin-top: 5px; } </style> </head> <body class="d-flex flex-column h-100"> <main class="flex-shrink-0"> <div>  <nav class="navbar navbar-expand-lg navbar-dark bg-dark" aria-label="Fifth navbar example"> <div class="container-fluid"> <a class="navbar-brand" href="/"><img src="/images/feather.png" style="height: 32px;"/> Apache Infrastructure</a> <button class="navbar-toggler" type="button" data-bs-toggle="collapse" data-bs-target="#navbarADP" aria-controls="navbarADP" aria-expanded="false" aria-label="Toggle navigation"> <span class="navbar-toggler-icon"></span> </button> <div class="collapse navbar-collapse" id="navbarADP"> <ul class="navbar-nav me-auto mb-2 mb-lg-0"> <li class="nav-item dropdown"> <a class="nav-link dropdown-toggle" href="#" data-bs-toggle="dropdown" aria-expanded="false">About</a> <ul class="dropdown-menu"> <li><a class="dropdown-item" href="/infra-news.html">News</a></li> <li><a class="dropdown-item" href="/blog/">The Infrastructure Blog</a></li> <li><a class="dropdown-item" href="/roundtable.html">The Infrastructure Roundtable</a></li> <li><a class="dropdown-item" href="/team.html">About the team</a></li> </ul> </li> <li class="nav-item"> <a class="nav-link" href="/policies.html">Policies</a> </li> <li class="nav-item dropdown"> <a class="nav-link dropdown-toggle" href="#" data-bs-toggle="dropdown" aria-expanded="false">Services and Tools</a> <ul class="dropdown-menu"> <li><a class="dropdown-item" href="/services.html">Services and Tools</a></li> <li><a class="dropdown-item" href="https://blocky.apache.org/">Blocky</a></li> <li><a class="dropdown-item" href="https://app.datadoghq.com/account/login?next=%2Finfrastructure">DataDog</a></li> <li><a class="dropdown-item" href="https://whimsy.apache.org/roster/committer/" target="_blank">Committer Search</a></li> </ul> </li> <li class="nav-item dropdown"> <a class="nav-link dropdown-toggle" href="#" data-bs-toggle="dropdown" aria-expanded="false">Documentation</a> <ul class="dropdown-menu"> <li><a class="dropdown-item" href="/doc.html">Infra docs</a></li> <li><a class="dropdown-item" href="/present.html">Infra presentations</a></li> </ul> </li> <li class="nav-item dropdown"> <a class="nav-link dropdown-toggle" href="#" data-bs-toggle="dropdown" aria-expanded="false">Contribute</a> <ul class="dropdown-menu"> <li><a class="dropdown-item" href="/infra-volunteer.html">Volunteer with Infra</a></li> <li><a class="dropdown-item" href="/how-to-mirror.html">Become an ASF download mirror</a></li> <li><a class="dropdown-item" href="/hosting-external-agent.html">Host a Jenkins or Buildbot agent</a></li> </ul> </li> <li class="nav-item"> <a class="nav-link" href="/stats.html">Status</a> </li> <li class="nav-item"> <a class="nav-link" href="/contact.html">Contact Us</a> </li> <li class="nav-item dropdown"> <a href="#" class="nav-link dropdown-toggle hidden-xs" data-bs-toggle="dropdown"><span class="fa-solid fa-magnifying-glass" aria-hidden="true"></span> Search</a> <ul class="search-form dropdown-menu"> <li> <div id="pagefind-search" class="input-group" style="width: 100%; padding: 0 5px;"></div> </li> </ul> </li> </ul> </div> </div> </nav>  <div id="contents"> <div class="bg-white p-5 rounded"> <div class="col-sm-8 mx-auto"> <h1> Content Security Policy for project websites </h1> <p>This policy becomes effective <strong>March 1, 2025</strong>.</p> <p>For your project's website:</p> <ul> <li>External trackers from 3rd party providers are <strong>not allowed</strong>. The ASF offers <a href="https://matomo.org/" target="_blank">Matomo</a> analytics for all project websites through <a href="https://analytics.apache.org" target="_blank">analytics.apache.org</a>.</li> <li>External resources, such as videos or PDFs, from providers with which we do not have a Data Processing Agreement (DPA) are <strong>not allowed</strong> to be embedded in the project's website. If you have a DPA request or inquiry, contact <code>privacy@apache.org</code>. They can also tell you if a provider whose content you want to embed in your website has already signed a DPA.</li> <li>Links to external resources <strong>are allowed</strong> if the site visitor must give explicit consent in order to see or use the content. This consent cannot be opt-out, and there must be a clear way for the visitor to retract consent at a later time.</li> </ul> <p>This policy brings project websites into alignment with the security and privacy parameters defined by the VP, Data Privacy and as requested by The ASF Security Committee. We ask that projects do not circumvent them without express permission from our VP, Data Privacy.</p> <p>Review The ASF's project website policy <a href="https://privacy.apache.org/policies/website-policy.html" target="_blank">here</a>.</p> </div> </div> </div>  <div class="row"> <div class="large-12 medium-12 columns"> <p style="font-style: italic; font-size: 0.8rem; text-align: center;"> Copyright 2025, <a href="https://www.apache.org/">The Apache Software Foundation</a>, Licensed under the <a href="https://www.apache.org/licenses/LICENSE-2.0">Apache License, Version 2.0</a>.<br/> Apache® and the Apache feather logo are trademarks of The Apache Software Foundation. </p> </div> </div> <script type="application/ecmascript" src="/js/bootstrap.bundle.min.js" integrity="sha384-OERcA2EqjJCMA+/3y+gxIOqMEjwtxJY7qPCqsdltbNJuaOe923+mo//f6V8Qbsw3"></script> </div> </main> <script>hljs.initHighlightingOnLoad();</script> </body> </html>

CINXE.COM

Content Security Policy for project websites - Apache Infrastructure Website