fix(download): 403/401 and 0-byte downloads are errors, not success - #186
Merged
Conversation
Two trust fixes in the download path: - The empty `case http.StatusForbidden:` in downloadPreset silently matched 403 responses and returned nil, so the forbidden body was read as a successful download. 403 and 401 now hard-error via accessDeniedError, which detects rate-limit-shaped responses (X-RateLimit-Remaining: 0 or a body mentioning "rate limit") and hints to set GITHUB_TOKEN. Applied to both downloadPreset and downloadAsset. (#161) - The raw-binary write paths reported success without checking that any bytes landed. verifyWritten now rejects 0-byte writes and Content-Length mismatches with an error naming the file and the observed size, so "updated ... done!" can no longer mask a failed download. (#163) Tests (httptest): 403 with rate-limit header/body -> GITHUB_TOKEN hint; plain 403 and 401 -> status-named errors; 200 empty body -> 0-byte error; 200 with body -> success with content verified. Mutation-checked: re-blanking the 403 case fails all three 403 tests; disabling the 0-byte check fails both empty-body tests. Fixes #161 Fixes #163 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_016DJzGS3pNBzZs1jaEQ74Co
fentas
pushed a commit
that referenced
this pull request
Aug 30, 2026
🤖 I have created a release *beep* *boop* --- ## [4.18.7](v4.18.6...v4.18.7) (2026-08-28) ### Bug Fixes * **download:** 403/401 and 0-byte downloads are errors, not success ([#186](#186)) ([782f5ed](782f5ed)) --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
The download trust pair: a 403/401 response or a 0-byte landing can no longer be reported as a successful download.
Fixes #161
Fixes #163
#161 — empty
case http.StatusForbidden:The status switch in
downloadPreset(pkg/binary/download.go) had an emptycase http.StatusForbidden:. Go cases do not fall through, so a 403 matched the empty case, returnednil, and the forbidden body was read as the binary. Now:403and401hard-error via a sharedaccessDeniedErrorhelper.X-RateLimit-Remaining: 0header, or a body mentioning "rate limit") gets the hint:rate limit exhausted; set GITHUB_TOKEN to authenticate.access denied; check credentials (for GitHub, set GITHUB_TOKEN).downloadAsset(provider path), and the 429 message now carries the retry/GITHUB_TOKEN hint too.#163 — "updated … done!" with 0 B on disk
The raw-binary write paths reported success without checking that any bytes landed. A new
verifyWrittencheck runs after the copy in bothdownloadPresetanddownloadAsset:download of <file> wrote 0 bytes: the server sent an empty body; retry the downloadContent-Length->download of <file> is incomplete: wrote N bytes, Content-Length is M; retry the downloadTests
httptest-based, inpkg/binary/binary_test.go:X-RateLimit-Remaining: 0-> error mentioningGITHUB_TOKEN, no file writtenGITHUB_TOKENMutation-checked: re-blanking the 403 case fails all three 403 tests; disabling the 0-byte check fails both empty-body tests.
go build ./... && go test ./...green;gofmt -lclean.🤖 Generated with Claude Code
https://claude.ai/code/session_016DJzGS3pNBzZs1jaEQ74Co