[External] repo.steampowered.com "latest-steam-client-general-availability" serves inconsistent snapshot revisions from Google Media CDN

[c0des1ayr]

The following URL intermittently serves two different versions of the same file, depending on which CDN edge responds:

https://repo.steampowered.com/steamrt-images-scout/snapshots/latest-steam-client-general-availability/com.valvesoftware.SteamRuntime.Sdk-amd64,i386-scout-sysroot.tar.gz

This causes download clients to encounter Content-Length / Content-Range mismatches and makes resumed downloads unreliable.

Using the corresponding immutable snapshot path avoids the issue entirely.

Expected behavior:
The latest-steam-client-general-availability alias should consistently resolve to a single snapshot revision across all CDN edges.

Every request for the URL above should return identical values for:

• ETag
• Last-Modified
• Content-Length

Actual behavior:
Repeated requests to the same URL alternate between two different objects.

Response A

HTTP/1.1 200 OK
Server: Google-Edge-Cache
Content-Length: 706479488
Last-Modified: Thu, 18 Jun 2026 14:41:00 GMT
ETag: "6a34037c-2a1c0580"
Age: 17812
X-CDN-Policy: :Google-Media-CDN

Response B

HTTP/1.1 200 OK
Server: Google-Edge-Cache
Content-Length: 706110603
Last-Modified: Mon, 25 May 2026 01:19:40 GMT
ETag: "6a13a3ac-2a16648b"
Age: 33555
X-CDN-Policy: :Google-Media-CDN

The responses differ in:

• Content-Length
• Last-Modified
• ETag

while being returned for the same URL.

This causes download tools (e.g. wget) to receive different metadata depending on which edge serves the request, which (at least personally) resulted in repeated download failures due to mismatched object sizes and failed resume attempts, as well as preventing me from compiling an AUR package successfully.

Workaround:
By downloading the latest snapshot directly:

https://repo.steampowered.com/steamrt-images-scout/snapshots/1.0.20260618.246542/com.valvesoftware.SteamRuntime.Sdk-amd64,i386-scout-sysroot.tar.gz

the download worked correctly, and the archive's SHA-256 checksum matched what was in the published SHA256SUMS file.

This makes it seem to be a CDN cache inconsistency affecting the latest-steam-client-general-availability alias instead of the snapshot itself.

Since the static snapshot downloads correctly and verifies successfully, the archives appear to be fine.

[smcv]

With hindsight, the /latest-whatever/ aliases were not a great design: they're inherently subject to this sort of inconsistency. Even if there weren't multiple routes through the CDN cache, you'd get inconsistent results if you were unlucky enough to be halfway through downloading a version at the time that the latest version changes.

A better way to download one of the "aliases" like latest-steam-client-general-availability is to do what the Steam Runtime machinery refers to as "pinning" internally (for example here):

1. Avoid steamrt-images-scout/ etc., use https://repo.steampowered.com/steamrt1/images/ etc. instead. (scout is Steam Runtime 1, soldier is 2, sniper is 3, everything newer is obvious.)
2. Download a file like https://repo.steampowered.com/steamrt1/images/latest-steam-client-general-availability.txt
3. Take the version number read from that file (today it's 1.0.20260618.246542), and construct a URL https://repo.steampowered.com/steamrt1/images/1.0.20260618.246542/
4. Download everything else from there

We've been trying to make older URLs into redirects to maintain backwards compatibility, but the Google Media CDN doesn't seem to like redirects (for example https://repo.steampowered.com/steamrt1/images/latest-steam-client-general-availability/ currently returns a Google internal error, instead of redirecting you to 1.0.20260618.246542 like it should), so it might become necessary to remove the old URLs completely :-(