Unable to fetch latest master commit.

[Danp]

Does it fail every time or is it an intermittent issue?

[acebmxer]

@Danp

It happened when i updated to de9687e i was hoping it would fix itself after this update but no still an issue.

[acebmxer]

[marcoi]

Same for me.

ill try to update manually and see if it changes.

[robertblissitt]

Greetings! I have been seeing the same since yesterday and it is happening every time. I rolled back to a previous version yesterday and the failure notice was no longer displayed. I ran the XenOrchestraInstallerUpdater script again this morning, and while it did update successfully, the failure notice has returned.

[marcoi]

same with me and latest update

[archw]

@marcoi
Same for me.

[acebmxer]

@danp

Just check with AI to make sure this was not cause my install script.. Here is the report it came back with...

`
It's an upstream issue in Xen Orchestra itself — neither this project nor the installer scripts are at fault. I traced the exact cause:

What's happening
The "Failed to fetch latest master commit" message comes from XO's own web UI (the About page). It's defined upstream in xo-web's messages.js and displayed when the page can't retrieve the latest master commit.
That check runs in your browser: the About page calls fetch('https://api.github.com/repos/vatesfr/xen-orchestra/commits/master') directly from the client (see _callGithubApi in xo-web/src/common/xo/index.js).
On 2026-07-22, upstream merged PR #10101 — "feat(xo-server): add content security policy" (commit 8e8afeb, a few hours before de9687e). It makes xo-server send a default CSP header with default-src 'self' and no connect-src directive — so browsers now block the About page's call to api.github.com.
This explains every symptom in the forum thread: it appeared right at de9687e (the first commit most people landed on after the CSP merge), rolling back fixes it, rebuilding on latest master brings it back, and the installer script itself still fetches commits fine — the CSP only affects the browser, not server-side git.
No one has filed an upstream issue for this yet — only the original PR exists. It would be worth reporting on vatesfr/xen-orchestra (the fix is for them to add connect-src 'self' https://api.github.com to their default CSP, since source installs need it for the update check).

Workaround until upstream fixes it
The PR's design lets config values extend the default CSP (array values are concatenated onto the defaults):

Open /etc/xo-server/config.toml (where this project's installer writes the config).
Add this section:

[http.helmet.contentSecurityPolicy.directives]
connect-src = ["'self'", "https://api.github.com"]
Restart xo-server: sudo systemctl restart xo-server.

Reload the About page (hard refresh, Ctrl+Shift+R) and verify the master commit shows again.
If you'd like, I can add that CSP directive to this project's config generation so fresh installs and rebuilds get it automatically — say the word and I'll make the change.

Sources: xcp-ng forum thread, PR #10101, xo-web About view source

[Danp]

Thanks for the reports and the detailed analysis. I'll make sure that the XOA team is notified.

[acebmxer]

@Danp

I was about to ask if there has been any update on this... I just did an update and it appears to be working again..

[olivierlambert]

Yes, it has been merged on main 2 hours ago, as visible at https://github.com/vatesfr/xen-orchestra/commit/b7bce8e7e71f7fd3cde61b74024bd5e0fb5b5a5d