fix(release): a release file's download leaves the token behind when Forgejo redirects it to R2

No reviewers

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

MagicBeanDev/Longshot!154

HumanBean commented

2026-11-13 07:37:38 +00:00

Owner

Why

Forgejo now keeps release files in Cloudflare R2: a release file's link answers 303 to a signed R2 link, and R2 refuses a request that also carries a token (HTTP 400). release.py's download() sends the job's token and urllib passes it on, so the tag path's check of the commit's nightly (released-as, which reads its SHA256SUMS and signature) fails, and the next rc or stable tag would stop at The version.

What changed

scripts/release.py: download() opens with a redirect handler that drops Authorization when a redirect leaves the host it was sent to; the forge still gets the token.
tests/test_release.py: a forge stand-in that redirects to a store stand-in refusing a token. It fails on main (HTTP 400) and passes here.
The two files stay byte-identical with MagicBeanDev/LongshotLauncher (same PR there).

Checked live: v3.0.0-rc.1/SHA256SUMS gives 200 through one redirect to R2 without a token, and 400 with one. Packages (/api/packages) are served directly, no change. The launcher (AllowAutoRedirect), setup.c (WinHTTP) and the Linux builder's downloads follow redirects and send no token.

Flags and settings

None

Measurements

main: 6b7fa356 (2026-11-13)
this PR: fix/release-r2-redirect @ d8fb5b59

download() of a release file that Forgejo redirects to R2, with RELEASE_TOKEN set	main @ `6b7fa356`	this PR @ `d8fb5b59`
result (tests/test_release.py, TokenStaysHome)	HTTP 400, the run stops	the file

Testing

Tested: tests/test_release.py (all pass; the new test fails on main's release.py); the live 200/400 above.

Not tested: a tag run on the runner; the next rc tag shows it.

Needs other testers: None

Screenshots

Nothing on screen

Risk and rollback

A redirect within the forge keeps the token as before. Reverting the commit is enough.

Checklist

For everyone

One topic.
The title is a Conventional Commit (type(scope): description).
Rebased on current main.
python -I -B tests/run_all.py run and passing (any failure that also fails on main is named above).
Tested in the game, or what wasn't is named under Testing.
Testing filled in: what was tested, what wasn't, and what needs other testers (with test requests).
Measured: main and this PR at named commits, on the same PC, scene and settings, at least 2 interleaved runs each, the median reported.
No game files, dumps, build output or generated files.
third_party/ untouched (a new folder with a PROVENANCE.md instead).
The license is OK: GPL-3.0-or-later, nothing incompatible and nothing decompiled.

## Why Forgejo now keeps release files in Cloudflare R2: a release file's link answers 303 to a signed R2 link, and R2 refuses a request that also carries a token (HTTP 400). `release.py`'s `download()` sends the job's token and urllib passes it on, so the tag path's check of the commit's nightly (`released-as`, which reads its SHA256SUMS and signature) fails, and the next rc or stable tag would stop at *The version*. ## What changed - `scripts/release.py`: `download()` opens with a redirect handler that drops `Authorization` when a redirect leaves the host it was sent to; the forge still gets the token. - `tests/test_release.py`: a forge stand-in that redirects to a store stand-in refusing a token. It fails on main (HTTP 400) and passes here. - The two files stay byte-identical with MagicBeanDev/LongshotLauncher (same PR there). Checked live: `v3.0.0-rc.1/SHA256SUMS` gives 200 through one redirect to R2 without a token, and 400 with one. Packages (`/api/packages`) are served directly, no change. The launcher (`AllowAutoRedirect`), `setup.c` (WinHTTP) and the Linux builder's downloads follow redirects and send no token. ## Flags and settings None ## Measurements main: 6b7fa356 (2026-11-13) this PR: fix/release-r2-redirect @ d8fb5b59 | download() of a release file that Forgejo redirects to R2, with RELEASE_TOKEN set | main @ 6b7fa356 | this PR @ d8fb5b59 | |---|---|---| | result (tests/test_release.py, TokenStaysHome) | HTTP 400, the run stops | the file | ## Testing **Tested:** `tests/test_release.py` (all pass; the new test fails on main's release.py); the live 200/400 above. **Not tested:** a tag run on the runner; the next rc tag shows it. **Needs other testers:** None ## Screenshots Nothing on screen ## Risk and rollback A redirect within the forge keeps the token as before. Reverting the commit is enough. ## Checklist ### For everyone - [x] One topic. - [x] The title is a Conventional Commit (`type(scope): description`). - [x] Rebased on current `main`. - [x] `python -I -B tests/run_all.py` run and passing (any failure that also fails on `main` is named above). - [x] Tested in the game, or what wasn't is named under Testing. - [x] Testing filled in: what was tested, what wasn't, and what needs other testers (with test requests). - [x] Measured: main and this PR at named commits, on the same PC, scene and settings, at least 2 interleaved runs each, the median reported. - [x] No game files, dumps, build output or generated files. - [x] `third_party/` untouched (a new folder with a `PROVENANCE.md` instead). - [x] The license is OK: GPL-3.0-or-later, nothing incompatible and nothing decompiled.

HumanBean added 1 commit

fix(release): a release file's download leaves the token behind when Forgejo redirects it to R2

CI / Python source checks (ubuntu-24.04, part 1/2) (pull_request) Has been skipped

Details

CI / Python source checks (ubuntu-24.04, part 2/2) (pull_request) Has been skipped

CI / SPIR-V fixtures (global narrow load/store, direct surface atomics, F2I immediate) (pull_request) Has been skipped

Third-party parts / The same as upstream (pull_request) Has been skipped

PR description / Description follows the template (pull_request_target) Successful in 3s

CI / Conventional Commit title (pull_request) Successful in 2s

CI / Workflow lint (actionlint) (pull_request) Successful in 4s

Third-party parts / As their notes say (pull_request) Successful in 5s

d8fb5b5938

HumanBean merged commit 1be180bbba into main

2026-11-13 07:41:23 +00:00

HumanBean deleted branch fix/release-r2-redirect

HumanBean referenced this pull request from a commit

2026-11-13 07:41:24 +00:00

fix(release): a release file's download leaves the token behind when Forgejo redirects it to R2 (#154)

Rows
Columns

fix(release): a release file's download leaves the token behind when Forgejo redirects it to R2 #154

Why