fix(release): a release file's download leaves the token behind when Forgejo redirects it to R2

## Why Forgejo now keeps release files in Cloudflare R2: a release file's link answers 303 to a signed R2 link, and R2 refuses a request that also carries a token (HTTP 400). `release.py`'s `download()` sends the job's token and urllib passes it on, so the tag path's check of the commit's nightly (`released-as`, which reads its SHA256SUMS and signature) fails, and the next rc or stable tag would stop at *The version*. ## What changed - `scripts/release.py`: `download()` opens with a redirect handler that drops `Authorization` when a redirect leaves the host it was sent to; the forge still gets the token. - `tests/test_release.py`: a forge stand-in that redirects to a store stand-in refusing a token. It fails on main (HTTP 400) and passes here. - The two files stay byte-identical with MagicBeanDev/Longshot (same PR there). Checked live: `v3.0.0-rc.1/SHA256SUMS` gives 200 through one redirect to R2 without a token, and 400 with one. Packages (`/api/packages`) are served directly, no change. The launcher (`AllowAutoRedirect`), `setup.c` (WinHTTP) and the Linux builder's downloads follow redirects and send no token. ## Flags and settings None ## Measurements main: 232356eb (2026-11-13) this PR: fix/release-r2-redirect @ 63820554 | download() of a release file that Forgejo redirects to R2, with RELEASE_TOKEN set | main @ 232356eb | this PR @ 63820554 | |---|---|---| | result (tests/test_release.py, TokenStaysHome) | HTTP 400, the run stops | the file | ## Testing **Tested:** `tests/test_release.py` (all pass; the new test fails on main's release.py); the live 200/400 above. **Not tested:** a tag run on the runner; the next rc tag shows it. **Needs other testers:** None ## Screenshots Nothing on screen ## Risk and rollback A redirect within the forge keeps the token as before. Reverting the commit is enough. ## Checklist ### For everyone - [x] One topic. - [x] The title is a Conventional Commit (`type(scope): description`). - [x] Rebased on current `main`. - [x] `python -I -B tests/run_all.py` run and passing (any failure that also fails on `main` is named above). - [x] Tested in the game, or what wasn't is named under Testing. - [x] Testing filled in: what was tested, what wasn't, and what needs other testers (with test requests). - [x] Measured: main and this PR at named commits, on the same PC, scene and settings, at least 2 interleaved runs each, the median reported. - [x] No game files, dumps, build output or generated files. - [x] `third_party/` untouched (a new folder with a `PROVENANCE.md` instead). - [x] The license is OK: GPL-3.0-or-later, nothing incompatible and nothing decompiled.

HumanBean commented

2026-11-13 07:37:40 +00:00

Owner

Why

Forgejo now keeps release files in Cloudflare R2: a release file's link answers 303 to a signed R2 link, and R2 refuses a request that also carries a token (HTTP 400). release.py's download() sends the job's token and urllib passes it on, so the tag path's check of the commit's nightly (released-as, which reads its SHA256SUMS and signature) fails, and the next rc or stable tag would stop at The version.

What changed

scripts/release.py: download() opens with a redirect handler that drops Authorization when a redirect leaves the host it was sent to; the forge still gets the token.
tests/test_release.py: a forge stand-in that redirects to a store stand-in refusing a token. It fails on main (HTTP 400) and passes here.
The two files stay byte-identical with MagicBeanDev/Longshot (same PR there).

Checked live: v3.0.0-rc.1/SHA256SUMS gives 200 through one redirect to R2 without a token, and 400 with one. Packages (/api/packages) are served directly, no change. The launcher (AllowAutoRedirect), setup.c (WinHTTP) and the Linux builder's downloads follow redirects and send no token.

Flags and settings

None

Measurements

main: 232356eb (2026-11-13)
this PR: fix/release-r2-redirect @ 63820554

download() of a release file that Forgejo redirects to R2, with RELEASE_TOKEN set	main @ `232356eb`	this PR @ `63820554`
result (tests/test_release.py, TokenStaysHome)	HTTP 400, the run stops	the file

Testing

Tested: tests/test_release.py (all pass; the new test fails on main's release.py); the live 200/400 above.

Not tested: a tag run on the runner; the next rc tag shows it.

Needs other testers: None

Screenshots

Nothing on screen

Risk and rollback

A redirect within the forge keeps the token as before. Reverting the commit is enough.

Checklist

For everyone

One topic.
The title is a Conventional Commit (type(scope): description).
Rebased on current main.
python -I -B tests/run_all.py run and passing (any failure that also fails on main is named above).
Tested in the game, or what wasn't is named under Testing.
Testing filled in: what was tested, what wasn't, and what needs other testers (with test requests).
Measured: main and this PR at named commits, on the same PC, scene and settings, at least 2 interleaved runs each, the median reported.
No game files, dumps, build output or generated files.
third_party/ untouched (a new folder with a PROVENANCE.md instead).
The license is OK: GPL-3.0-or-later, nothing incompatible and nothing decompiled.