Mise fails to install 'aqua:gitea.com/gitea/[email protected]' due to incorrect redirect handling

[SVHawk13]

When making a HEAD request to https://gitea.com/gitea/tea/releases/download/v0.10.1/tea-0.10.1-linux-amd64.xz, the web server responds with an HTTP 303 status code and redirects the user agent.
http.rs follows the redirect and attempts a HEAD request for the URI in the Location header.
However, this URI is to a Cloudflare R2 instance, and the URI includes a signed signature for the request. When attempting a HEAD request on the URI (from mise or using cURL), the R2 instance responds with an HTTP status code 403. However, using a GET request instead downloads the file as expected.

mise_doctor_output.log
mise_install_output.log

[risu729]

I'm investigating this issue. This is not an issue of mise, but I thikn I can fix it.

[risu729]

I opened an issue go-gitea/gitea#35086 and a PR go-gitea/gitea#35088.

Also, I don't think this should be merged, but #5647 will fix the issue.
So if you really need the package, you can build and use it.

[SVHawk13]

MDN says that "The method to retrieve the redirected resource is always GET", but the RFC doesn't state that the UA should change the request from HEAD to GET when presented with a 303. I wasn't sure what to make of that.

Thank you for your help!

[risu729]

Yeah, it's confusing. I wrote about it in the issue:

Consequently, many HTTP clients, including curl, xh, and JavaScript fetch, do not change the request method from HEAD to GET during a 303 redirection.
Although this is not a MUST NOT requirement, as it is for a 307 Temporary Redirect, it is a common implementation.

Also, tower-http, the dependency of reqwest, the HTTP library mise is using, doesn't change the method for HEAD.

https://github.com/tower-rs/tower-http/blob/075479b852f348c8b74245f478b9012090acf5fc/tower-http/src/follow_redirect/mod.rs#L282-L289

[risu729]

This is now fixed on Gitea side!