Incorrect redirect when `download_site_uri` is present

Open Beginner friendly
#160 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
2/5
Estimated time
1-3 hours
Newbie friendliness
68/100
Issue type
Bug
Clarity
Clearly specified
Activity status
Quiet
Tech stack
java
Domain
api, backend

Research direction

Start at the /ids/{id}/redirect endpoint and compare its behavior with the package response fields shown in the report. Reproduce the request using the supplied package ID, then inspect the redirect handling for cases where both direct_download_uri and download_site_uri are present. Done means the redirect points to direct_download_uri and the existing download behavior remains intact.

Written by the indexing model from the issue text.

Description

It seems when packages have the download_site_uri set (which doesn't seem to be common) then hitting the /redirect for that particular package will redirect to download_site_uri instead of direct_download_uri, even when direct_download_uri is present and correct.

GET https://api.foojay.io/disco/v3.0/ids/9d7cb147358cf7ea8e0ff46dfbc38c36

HTTP/2 200 OK

{
  "result": [
    {
      "filename": "graalvm-community-jdk-25i1-25.0.3_linux-x64_bin.tar.gz",
      "direct_download_uri": "https://github.com/graalvm/graalvm-ce-builds/releases/download/graal-25.1.3/graalvm-community-jdk-25i1-25.0.3_linux-x64_bin.tar.gz",
      "download_site_uri": "https://github.com/graalvm/graalvm-ce-builds/releases",
      "signature_uri": "",
      "checksum_uri": "https://github.com/graalvm/graalvm-ce-builds/releases/download/graal-25.1.3/graalvm-community-jdk-25i1-25.0.3_linux-x64_bin.tar.gz.sha256",
      "checksum": "e9cd1637be853e105f8b09125b4b19fbce385696465d782cbca8bb80e1df8f0d",
      "checksum_type": "sha256"
    }
  ],
  "message": ""
}

but

GET https://api.foojay.io/disco/v3.0/ids/9d7cb147358cf7ea8e0ff46dfbc38c36/redirect

HTTP/2 301 Moved Permanently

location: https://github.com/graalvm/graalvm-ce-builds/releases

And so the resulting download ends up with the HTML content of the GitHub releases page, which naturally doesn't work

 Some toolchain resolvers had provisioning failures: foojay (Unable to download toolchain matching the requirements ({languageVersion=25, vendor=GraalVM Community, implementation=vendor-specific, nativeImageCapable=false}) from 'https://api.foojay.io/disco/v3.0/ids/9d7cb147358cf7ea8e0ff46dfbc38c36/redirect', due to: Cannot expand TAR '~/.gradle/jdks/releases-GraalVM-Community-25'.).
Dominant language
Java
Stars
154
Forks
18
PR merge metrics
No merged PRs in 30d

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from foojayio/discoapi

All issues in foojayio/discoapi

Similar issues

More Java issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.