foojayio / foojayio/discoapi

Incorrect redirect when `download_site_uri` is present

Open Beginner friendly
#160 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Java
Stars
154
Forks
17
PR merge metrics
No merged PRs in 30d

Description

It seems when packages have the `download_site_uri` set (which doesn't seem to be common) then hitting the `/redirect` for that particular package will redirect to `download_site_uri` instead of `direct_download_uri`, even when `direct_download_uri` is present and correct.

```http
GET https://api.foojay.io/disco/v3.0/ids/9d7cb147358cf7ea8e0ff46dfbc38c36

HTTP/2 200 OK

{
"result": [
{
"filename": "graalvm-community-jdk-25i1-25.0.3_linux-x64_bin.tar.gz",
"direct_download_uri": "https://github.com/graalvm/graalvm-ce-builds/releases/download/graal-25.1.3/graalvm-community-jdk-25i1-25.0.3_linux-x64_bin.tar.gz",
"download_site_uri": "https://github.com/graalvm/graalvm-ce-builds/releases",
"signature_uri": "",
"checksum_uri": "https://github.com/graalvm/graalvm-ce-builds/releases/download/graal-25.1.3/graalvm-community-jdk-25i1-25.0.3_linux-x64_bin.tar.gz.sha256",
"checksum": "e9cd1637be853e105f8b09125b4b19fbce385696465d782cbca8bb80e1df8f0d",
"checksum_type": "sha256"
}
],
"message": ""
}
```

but

```http
GET https://api.foojay.io/disco/v3.0/ids/9d7cb147358cf7ea8e0ff46dfbc38c36/redirect

HTTP/2 301 Moved Permanently

location: https://github.com/graalvm/graalvm-ce-builds/releases
```

And so the resulting download ends up with the HTML content of the GitHub releases page, which naturally doesn't work

```
Some toolchain resolvers had provisioning failures: foojay (Unable to download toolchain matching the requirements ({languageVersion=25, vendor=GraalVM Community, implementation=vendor-specific, nativeImageCapable=false}) from 'https://api.foojay.io/disco/v3.0/ids/9d7cb147358cf7ea8e0ff46dfbc38c36/redirect', due to: Cannot expand TAR '~/.gradle/jdks/releases-GraalVM-Community-25'.).
```

Contributor guide

No contributing guide indexed for this repository

Research direction

Start at the /ids/{id}/redirect endpoint and compare its behavior with the package response fields shown in the report. Reproduce the request using the supplied package ID, then inspect the redirect handling for cases where both direct_download_uri and download_site_uri are present. Done means the redirect points to direct_download_uri and the existing download behavior remains intact.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
api, backend
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Quiet
Clarity
Clearly specified
Newbie friendliness
68/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.