Make the Homebrew publisher request Forgejo asset bodies #1472

New issue

Closed

opened 2026-07-16 08:23:37 +00:00 by coilyco-ops · 2 comments

coilyco-ops commented

2026-07-16 08:23:37 +00:00

Member

Problem

Ward's bump-tap-formula job downloads releases/download/<tag>/<asset> without Accept: application/octet-stream. Current Forgejo responds with asset metadata JSON on that route. The job hashes that metadata, and the generated formula downloads metadata instead of the executable.

Evidence

The manual v0.775.0-tmp bootstrap release returns metadata without the header and a Mach-O or ELF binary with the header.
All four platform binaries match the published SHA256SUMS.
The recovery formula landed in coilyco-flight-deck/homebrew-tap at 8fae395 with the required header on every URL.

Done when

hash_asset requests application/octet-stream and verifies it received an executable asset.
Generated Homebrew URL stanzas include the same header.
Release contract tests cover Forgejo metadata responses and the emitted formula shape.

## Problem Ward's `bump-tap-formula` job downloads `releases/download/<tag>/<asset>` without `Accept: application/octet-stream`. Current Forgejo responds with asset metadata JSON on that route. The job hashes that metadata, and the generated formula downloads metadata instead of the executable. ## Evidence * The manual `v0.775.0-tmp` bootstrap release returns metadata without the header and a Mach-O or ELF binary with the header. * All four platform binaries match the published `SHA256SUMS`. * The recovery formula landed in `coilyco-flight-deck/homebrew-tap` at `8fae395` with the required header on every URL. ## Done when * `hash_asset` requests `application/octet-stream` and verifies it received an executable asset. * Generated Homebrew URL stanzas include the same header. * Release contract tests cover Forgejo metadata responses and the emitted formula shape.

coilyco-ops referenced this issue from a commit

2026-07-18 06:08:57 +00:00

fix(release): request Forgejo asset bodies (closes #1472)

coilyco-ops closed this issue

2026-07-18 06:08:57 +00:00

coilyco-ops commented

2026-07-21 04:45:29 +00:00

Author

Member

Regressed under the current Forgejo (15.0.2-rootless). Live evidence from the v0.781.0 release tonight:

releases/download/v0.781.0/ward-darwin-arm64 returns the same 280-byte asset-metadata JSON with and without Accept: application/octet-stream (identical sha both ways). The header no longer selects the body on this route.
The generated formula does carry the six header stanzas this issue added, and it hashed and installed the metadata anyway - brew upgrade landed a 280-byte non-executable "binary" on a real machine tonight.
The only byte-serving path is the browser_download_url from the metadata (/attachments/<uuid>), which serves the raw asset anonymously. The real v0.781.0 binary fetched that way matches the published .sha256.

Timing note: the Forgejo pod restarted about ten days ago, which lines up with when the release pipeline first broke - this route change was likely the first domino behind the ward#1328 streak.

Done-when for the reopen: the bump-tap-formula generator (and the hash step) resolve each asset's browser_download_url and emit/hash that, dropping the Accept-header stanzas; release contract tests assert attachment-URL formulas against a mock that serves metadata on the download route regardless of Accept. Scoop manifest generation has the same exposure. Overlaps the stage-2 migration tracked in #1492.

Filed by Claude Code during the release-pipeline repair session with Kai.

Regressed under the current Forgejo (15.0.2-rootless). Live evidence from the v0.781.0 release tonight: - `releases/download/v0.781.0/ward-darwin-arm64` returns the same 280-byte asset-metadata JSON with and without `Accept: application/octet-stream` (identical sha both ways). The header no longer selects the body on this route. - The generated formula does carry the six header stanzas this issue added, and it hashed and installed the metadata anyway - `brew upgrade` landed a 280-byte non-executable "binary" on a real machine tonight. - The only byte-serving path is the `browser_download_url` from the metadata (`/attachments/<uuid>`), which serves the raw asset anonymously. The real v0.781.0 binary fetched that way matches the published `.sha256`. Timing note: the Forgejo pod restarted about ten days ago, which lines up with when the release pipeline first broke - this route change was likely the first domino behind the ward#1328 streak. Done-when for the reopen: the bump-tap-formula generator (and the hash step) resolve each asset's `browser_download_url` and emit/hash that, dropping the Accept-header stanzas; release contract tests assert attachment-URL formulas against a mock that serves metadata on the download route regardless of Accept. Scoop manifest generation has the same exposure. Overlaps the stage-2 migration tracked in #1492. Filed by Claude Code during the release-pipeline repair session with Kai.

coilyco-ops commented

2026-07-21 04:47:32 +00:00

Author

Member

Correction to the comment above: staying closed. The regression is tracked as a fresh issue instead - ward#1493 carries the evidence and the browser_download_url done-when.

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

coilyco-flight-deck/ward#1472

No description provided.

Rows
Columns