Download in v4.6.0 does not work anymore

[tanrak]

Hi, in the current version (4.6.0) the download of files from the release page does not work anymore. OS is Lineage 16.0. Has anybody the same problem?

[maniac103]

Huh, I can reproduce. Will check it.

[maniac103]

OK, this happens as a direct consequence of the fix for #972. Since then we're sending the token via Authorization HTTP header. What happens now is the following. taking the Octodroid 4.6.0 release asset as example

• we request https://api.github.com/repos/slapperwan/gh4a/releases/assets/21031143 with application/octet-stream Accept header which flags to Github we want the binary, adding the Authorization header to the request
• Github responds with 302 Found response, redirecting us to AWS: location: https://github-production-release-asset-2e65be.s3.amazonaws.com/1388190/c36b2880-9e7a-11ea-99f9-218be1f3561b?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=AKIAIWNJYAX4CSVEH53A%2F20200527%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20200527T135312Z&X-Amz-Expires=300&X-Amz-Signature=c911eb4708c01bfbb4b54493e067b2c3401c4ca03dc9169ff3027a90ca86cc59&X-Amz-SignedHeaders=host&actor_id=0&repo_id=1388190&response-content-disposition=attachment%3B%20filename%3Dgh4a-460-release.apk&response-content-type=application%2Fvnd.android.package-archive
• in the redirection request, the Authorization header is still present
• AWS responds with 400 Bad Request, because <Code>InvalidArgument</Code><Message>Only one auth mechanism allowed; only the X-Amz-Algorithm query parameter, Signature query string parameter or the Authorization header should be specified</Message>, basically taking offense in the Authorization header in combination with the X-Amz-Algorithm query parameter the GH redirection added.

I'll ask their support.

[ThreeDeeJay]

Can any confirm whether downloads are still working in the latest version?
4.6.11+ doesn't start the download so I had to go back to 4.6.10 🤔