get-dotnetup: pin daily shortlink to concrete build to avoid checksum race#55147
Conversation
… race The daily/quality shortlink is a mutable pointer, so downloading the binary and its .sha512 as two separate requests can straddle a new build publish, yielding a binary from one build and a checksum from another (spurious checksum mismatch). Resolve the shortlink to its concrete versioned URL once (curl --head, with a pwsh 5.1-safe .NET WebRequest backup) and derive both the binary and checksum URLs from that single resolved URL so they always match. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
…vailable Minimal Linux images may ship only wget, so mirror the download() fallback in the shortlink resolver: parse the final Location header from 'wget --spider -S' (POSIX tolower(), portable across gawk/mawk/busybox). Resolution stays best-effort; if neither downloader can resolve it, the shortlink URLs are used. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
bash 3.2 (the default on macOS) preserves the backslashes from an escaped replacement in \, yielding a malformed 'https://ci.dot.net\/public-checksums\/...' URL and a failed checksum download. Use sed with a '#' delimiter, which is unambiguous and portable across BSD/macOS and GNU seds. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
There was a problem hiding this comment.
Pull request overview
This PR addresses intermittent dotnetup acquisition failures during toolset initialization by avoiding a checksum “race” across mutable aka.ms shortlinks. It resolves the aka.ms channel shortlink to a concrete build URL once, then derives both the binary URL and its .sha512 URL from that resolved URL so they always correspond to the same published build.
Changes:
- Add shortlink resolution in
get-dotnetup.sh(curl/wget) and use the resolved/public/…URL to derive the matching/public-checksums/…URL. - Add shortlink resolution in
get-dotnetup.ps1(curl.exe with a .NETWebRequestHEAD fallback) and similarly derive the checksum URL from the resolved build URL.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
| scripts/get-dotnetup.sh | Resolves aka.ms redirects to a concrete build URL and derives a stable checksum URL to avoid mismatches. |
| scripts/get-dotnetup.ps1 | Adds the same redirect-resolution logic (curl.exe / WebRequest HEAD fallback) and derives checksum URL from the resolved build URL. |
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
| # Checksums live under the sibling 'public-checksums' path with a .sha512 suffix. | ||
| $checksumUrl = ($resolvedUrl -replace '/public/', '/public-checksums/') + ".sha512" |
There was a problem hiding this comment.
Do we want to hard-code this? I'm not sure if there's a way around it.
There was a problem hiding this comment.
I agree with the hesitancy to hard-code though don't see a way around it.
| @@ -148,6 +179,17 @@ $fileName = if ($rid -like "win-*") { "dotnetup-$rid.exe" } else { "dotnetup-$ri | |||
| $downloadUrl = "$BaseUrl/$fileName" | |||
| $checksumUrl = "$downloadUrl.sha512" | |||
There was a problem hiding this comment.
Any reason to be setting the checksum (and really the download too) URL here since they're just going to be overwritten?
There was a problem hiding this comment.
This is done in case curl/wget fails then we can still try to use the old link (hoping that they don't race)
Resolves #55136
The daily/quality shortlink is a mutable pointer, so downloading the binary and its .sha512 as two separate requests can straddle a new build publish, yielding a binary from one build and a checksum from another (spurious checksum mismatch). Resolve the shortlink to its concrete versioned URL once (curl --head, with a pwsh 5.1-safe .NET WebRequest backup) and derive both the binary and checksum URLs from that single resolved URL so they always match.