[Slackbuilds-users] Serious regression on Github archive URLs

[Eric Pratt]

On Sat, Aug 18, 2018 at 10:37 AM Benjamin Trigona-Harany
<slackbuilds at jaxartes.net> wrote:
>
> Hopefully my last email on this topic. Here's my recommended solution that
> should be fully safe even if it does still requires a GitHub account:
>
> 1. Get your token as in my previous email
> 2. Add a .netrc for root with the following line:
> machine github.com login TOKEN password slack
> 3. Make sure wget is being called with the --auth-no-challenge flag. For
> exampl,e I have the following in my sbopkg.conf:
> WGETFLAGS="${WGETFLAGS:--c --progress=bar:force --timeout=30 --tries=5} --
> auth-no-challenge"
>
> As far as I can tell you need *something* for a password in .netrc - blank
> won't do - hence the "slack". In any case, .netrc will restrict the use of
> your GitHub token to only the GitHub domain.
>
> Unfortunately, wget needed the extra --auth-no-challenge flag, unlike cURL,
> but adding this as a default is less disruptive than updating 1000-odd
> SlackBuilds to accommodate the change in how GitHub is handling these URLs.
>
> Ben

I'm not sure I fully understand the problem, but here's what I found.
It looks like the URL pattern has changed to:

  https://github.com/<project>/<repo>/archive/<tag>.<extension>

So this works:

$ ls
$ wget -q https://github.com/geopython/OWSLib/archive/0.16.0.tar.gz
$ ls
0.16.0.tar.gz
$ tar -xzf 0.16.0.tar.gz
$ ls
0.16.0.tar.gz  OWSLib-0.16.0/
$

I tried this with a few projects with github DOWNLOAD URLs in the sbo
repo and it's working for all of them.  No account is needed.

On a side note, it appears that out of 1468 DOWNLOAD= entries in the
repo that use github, 7 of them are using http while the rest are
using https.

$ grep -r '^DOWNLOAD=' * | grep -o 'http[s]*://github.*$' | wc -l
1468
$ grep -r '^DOWNLOAD=' * | grep -o 'http://github.*$' | wc -l
7
$ grep -r '^DOWNLOAD=' * | grep -o 'https://github.*$' | wc -l
1461

It might be a good time to change all github downloads to use https
URLs.  I know it's a minor issue.  But I stumbled across it while
looking into this and thought I would do a one-time nag in case it
matters.