We are currently solving the following issue within our repository. Here is the issue text:
--- BEGIN ISSUE ---
Font problem in production
> Font from origin 'https://assets.gratipay.com' has been blocked from loading by Cross-Origin Resource Sharing policy: No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin 'https://gratipay.com' is therefore not allowed access. 


--- END ISSUE ---

Below are some code segments, each from a relevant file. One or more of these files may contain bugs.
--- BEGIN FILES ---
Path: `gratipay/utils/cache_static.py`
Content:
```
1 """
2 Handles caching of static resources.
3 """
4 from base64 import b64encode
5 from hashlib import md5
6 
7 from aspen import Response
8 
9 
10 ETAGS = {}
11 
12 
13 def asset_etag(path):
14     if path.endswith('.spt'):
15         return ''
16     if path in ETAGS:
17         h = ETAGS[path]
18     else:
19         with open(path) as f:
20             h = ETAGS[path] = b64encode(md5(f.read()).digest(), '-_').replace('=', '~')
21     return h
22 
23 
24 # algorithm functions
25 
26 def get_etag_for_file(dispatch_result):
27     return {'etag': asset_etag(dispatch_result.match)}
28 
29 
30 def try_to_serve_304(website, dispatch_result, request, etag):
31     """Try to serve a 304 for static resources.
32     """
33     if not etag:
34         # This is a request for a dynamic resource.
35         return
36 
37     qs_etag = request.line.uri.querystring.get('etag')
38     if qs_etag and qs_etag != etag:
39         # Don't serve one version of a file as if it were another.
40         raise Response(410)
41 
42     headers_etag = request.headers.get('If-None-Match')
43     if not headers_etag:
44         # This client doesn't want a 304.
45         return
46 
47     if headers_etag != etag:
48         # Cache miss, the client sent an old or invalid etag.
49         return
50 
51     # Huzzah!
52     # =======
53     # We can serve a 304! :D
54 
55     raise Response(304)
56 
57 
58 def add_caching_to_response(website, response, request=None, etag=None):
59     """Set caching headers for static resources.
60     """
61     if etag is None:
62         return
63     assert request is not None  # sanity check
64 
65     if response.code not in (200, 304):
66         return
67 
68     # https://developers.google.com/speed/docs/best-practices/caching
69     response.headers['Vary'] = 'accept-encoding'
70     response.headers['Etag'] = etag
71 
72     if request.line.uri.querystring.get('etag'):
73         # We can cache "indefinitely" when the querystring contains the etag.
74         response.headers['Cache-Control'] = 'public, max-age=31536000'
75     else:
76         # Otherwise we cache for 5 seconds
77         response.headers['Cache-Control'] = 'public, max-age=5'
78
```
--- END FILES ---

Please first localize the bug based on the issue statement, and then generate a patch according to the `git diff` format fenced by three backticks.

Here is an example:

```diff
diff --git a/examples/server_async.py b/examples/server_async.py
--- a/examples/server_async.py
+++ b/examples/server_async.py
@@ -313,4 +313,4 @@
 
 
 if __name__ == "__main__":
-    asyncio.run(run_async_server("."), debug=True)
+    asyncio.run(run_async_server(), debug=True)
diff --git a/examples/server_sync.py b/examples/server_sync.py
--- a/examples/server_sync.py
+++ b/examples/server_sync.py
@@ -313,5 +313,5 @@
 
 
 if __name__ == "__main__":
-    server = run_sync_server(".")
+    server = run_sync_server()
     server.shutdown()

```

diff --git a/gratipay/utils/cache_static.py b/gratipay/utils/cache_static.py
--- a/gratipay/utils/cache_static.py
+++ b/gratipay/utils/cache_static.py
@@ -68,6 +68,9 @@
     # https://developers.google.com/speed/docs/best-practices/caching
     response.headers['Vary'] = 'accept-encoding'
     response.headers['Etag'] = etag
+    # Set CORS header for https://assets.gratipay.com (see issue #2970)
+    if 'Access-Control-Allow-Origin' not in response.headers:
+        response.headers['Access-Control-Allow-Origin'] = 'https://gratipay.com'
 
     if request.line.uri.querystring.get('etag'):
         # We can cache "indefinitely" when the querystring contains the etag.

{"golden_diff": "diff --git a/gratipay/utils/cache_static.py b/gratipay/utils/cache_static.py\n--- a/gratipay/utils/cache_static.py\n+++ b/gratipay/utils/cache_static.py\n@@ -68,6 +68,9 @@\n     # https://developers.google.com/speed/docs/best-practices/caching\n     response.headers['Vary'] = 'accept-encoding'\n     response.headers['Etag'] = etag\n+    # Set CORS header for https://assets.gratipay.com (see issue #2970)\n+    if 'Access-Control-Allow-Origin' not in response.headers:\n+        response.headers['Access-Control-Allow-Origin'] = 'https://gratipay.com'\n \n     if request.line.uri.querystring.get('etag'):\n         # We can cache \"indefinitely\" when the querystring contains the etag.\n", "issue": "Font problem in production\n> Font from origin 'https://assets.gratipay.com' has been blocked from loading by Cross-Origin Resource Sharing policy: No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin 'https://gratipay.com' is therefore not allowed access. \n\n", "before_files": [{"content": "\"\"\"\nHandles caching of static resources.\n\"\"\"\nfrom base64 import b64encode\nfrom hashlib import md5\n\nfrom aspen import Response\n\n\nETAGS = {}\n\n\ndef asset_etag(path):\n    if path.endswith('.spt'):\n        return ''\n    if path in ETAGS:\n        h = ETAGS[path]\n    else:\n        with open(path) as f:\n            h = ETAGS[path] = b64encode(md5(f.read()).digest(), '-_').replace('=', '~')\n    return h\n\n\n# algorithm functions\n\ndef get_etag_for_file(dispatch_result):\n    return {'etag': asset_etag(dispatch_result.match)}\n\n\ndef try_to_serve_304(website, dispatch_result, request, etag):\n    \"\"\"Try to serve a 304 for static resources.\n    \"\"\"\n    if not etag:\n        # This is a request for a dynamic resource.\n        return\n\n    qs_etag = request.line.uri.querystring.get('etag')\n    if qs_etag and qs_etag != etag:\n        # Don't serve one version of a file as if it were another.\n        raise Response(410)\n\n    headers_etag = request.headers.get('If-None-Match')\n    if not headers_etag:\n        # This client doesn't want a 304.\n        return\n\n    if headers_etag != etag:\n        # Cache miss, the client sent an old or invalid etag.\n        return\n\n    # Huzzah!\n    # =======\n    # We can serve a 304! :D\n\n    raise Response(304)\n\n\ndef add_caching_to_response(website, response, request=None, etag=None):\n    \"\"\"Set caching headers for static resources.\n    \"\"\"\n    if etag is None:\n        return\n    assert request is not None  # sanity check\n\n    if response.code not in (200, 304):\n        return\n\n    # https://developers.google.com/speed/docs/best-practices/caching\n    response.headers['Vary'] = 'accept-encoding'\n    response.headers['Etag'] = etag\n\n    if request.line.uri.querystring.get('etag'):\n        # We can cache \"indefinitely\" when the querystring contains the etag.\n        response.headers['Cache-Control'] = 'public, max-age=31536000'\n    else:\n        # Otherwise we cache for 5 seconds\n        response.headers['Cache-Control'] = 'public, max-age=5'\n", "path": "gratipay/utils/cache_static.py"}], "after_files": [{"content": "\"\"\"\nHandles caching of static resources.\n\"\"\"\nfrom base64 import b64encode\nfrom hashlib import md5\n\nfrom aspen import Response\n\n\nETAGS = {}\n\n\ndef asset_etag(path):\n    if path.endswith('.spt'):\n        return ''\n    if path in ETAGS:\n        h = ETAGS[path]\n    else:\n        with open(path) as f:\n            h = ETAGS[path] = b64encode(md5(f.read()).digest(), '-_').replace('=', '~')\n    return h\n\n\n# algorithm functions\n\ndef get_etag_for_file(dispatch_result):\n    return {'etag': asset_etag(dispatch_result.match)}\n\n\ndef try_to_serve_304(website, dispatch_result, request, etag):\n    \"\"\"Try to serve a 304 for static resources.\n    \"\"\"\n    if not etag:\n        # This is a request for a dynamic resource.\n        return\n\n    qs_etag = request.line.uri.querystring.get('etag')\n    if qs_etag and qs_etag != etag:\n        # Don't serve one version of a file as if it were another.\n        raise Response(410)\n\n    headers_etag = request.headers.get('If-None-Match')\n    if not headers_etag:\n        # This client doesn't want a 304.\n        return\n\n    if headers_etag != etag:\n        # Cache miss, the client sent an old or invalid etag.\n        return\n\n    # Huzzah!\n    # =======\n    # We can serve a 304! :D\n\n    raise Response(304)\n\n\ndef add_caching_to_response(website, response, request=None, etag=None):\n    \"\"\"Set caching headers for static resources.\n    \"\"\"\n    if etag is None:\n        return\n    assert request is not None  # sanity check\n\n    if response.code not in (200, 304):\n        return\n\n    # https://developers.google.com/speed/docs/best-practices/caching\n    response.headers['Vary'] = 'accept-encoding'\n    response.headers['Etag'] = etag\n    # Set CORS header for https://assets.gratipay.com (see issue #2970)\n    if 'Access-Control-Allow-Origin' not in response.headers:\n        response.headers['Access-Control-Allow-Origin'] = 'https://gratipay.com'\n\n    if request.line.uri.querystring.get('etag'):\n        # We can cache \"indefinitely\" when the querystring contains the etag.\n        response.headers['Cache-Control'] = 'public, max-age=31536000'\n    else:\n        # Otherwise we cache for 5 seconds\n        response.headers['Cache-Control'] = 'public, max-age=5'\n", "path": "gratipay/utils/cache_static.py"}]}