@danp
Just check with AI to make sure this was not cause my install script.. Here is the report it came back with...
`
It's an upstream issue in Xen Orchestra itself — neither this project nor the installer scripts are at fault. I traced the exact cause:
What's happening
The "Failed to fetch latest master commit" message comes from XO's own web UI (the About page). It's defined upstream in xo-web's messages.js and displayed when the page can't retrieve the latest master commit.
That check runs in your browser: the About page calls fetch('https://api.github.com/repos/vatesfr/xen-orchestra/commits/master') directly from the client (see _callGithubApi in xo-web/src/common/xo/index.js).
On 2026-07-22, upstream merged PR #10101 — "feat(xo-server): add content security policy" (commit 8e8afeb, a few hours before de9687e). It makes xo-server send a default CSP header with default-src 'self' and no connect-src directive — so browsers now block the About page's call to api.github.com.
This explains every symptom in the forum thread: it appeared right at de9687e (the first commit most people landed on after the CSP merge), rolling back fixes it, rebuilding on latest master brings it back, and the installer script itself still fetches commits fine — the CSP only affects the browser, not server-side git.
No one has filed an upstream issue for this yet — only the original PR exists. It would be worth reporting on vatesfr/xen-orchestra (the fix is for them to add connect-src 'self' https://api.github.com to their default CSP, since source installs need it for the update check).
Workaround until upstream fixes it
The PR's design lets config values extend the default CSP (array values are concatenated onto the defaults):
Open /etc/xo-server/config.toml (where this project's installer writes the config).
Add this section:
[http.helmet.contentSecurityPolicy.directives]
connect-src = ["'self'", "https://api.github.com"]
Restart xo-server: sudo systemctl restart xo-server.
Reload the About page (hard refresh, Ctrl+Shift+R) and verify the master commit shows again.
If you'd like, I can add that CSP directive to this project's config generation so fresh installs and rebuilds get it automatically — say the word and I'll make the change.
Sources: xcp-ng forum thread, PR #10101, xo-web About view source
