New VirtualBox not downloading

[jessepeterson]

Reported to me in direct email that VirtualBox recipe is broken. I haven't had time to take a look but recording here for I have time.

[jessepeterson]

So I had very quick moment to look. The URL Provider in the recipes base the current version from this file: http://download.virtualbox.org/virtualbox/LATEST.TXT which still lists 4.3.16. I've seen this before where there's a delay in the release cycle. Autopkg tradition is to wait it out a while for the vendor to update their side. For all we know there's some reason they haven't updated the LATEST.TXT yet.

Feel free to reach out to the Oracle folk if you need this sooner!

[timsutton]

I noticed my client was still getting update notifications, so I took a look at the strings in /Applications/VirtualBox.app/Contents/MacOS/VirtualBox.dylib:

These contain references to
https://update.virtualbox.org/query.php

So I'm guessing they may have stopped using that textfile. I can't deduce the HTTP request, however, because their server seems to reject SSL certs other than those shipping with VirtualBox. All I can see is a User Agent that looks like:

VirtualBox 4.3.16 <macosx.64 [Product: Darwin | Release: 14.0.0 | Version: Darwin Kernel Version 14.0.0: Sat Sep 27 03:58:47 PDT 2014; root:xnu-2782.1.97~11/RELEASE_X86_64]>

[jessepeterson]

I cheated a bit to get this exchange:

Request:

GET /query.php?platform=DARWIN_64BITS_GENERIC&version=4.3.16_95972&count=97&branch=stable HTTP/1.1
Host: update.virtualbox.org
Accept: */*
User-Agent: VirtualBox 4.3.16 <macosx.64 [Product: Darwin | Release: 13.4.0 | Version: Darwin Kernel Version 13.4.0: Sun Aug 17 19:50:11 PDT 2014; root:xnu-2422.115.4~1/RELEASE_X86_64]>

Response:

HTTP/1.1 200 OK
Date: Thu, 16 Oct 2014 06:26:52 GMT
Server: Oracle-Application-Server-11g
X-Powered-By: PHP/5.4.19
Content-Length: 87
Content-Type: text/html
Content-Language: en

4.3.18 http://download.virtualbox.org/virtualbox/4.3.18/VirtualBox-4.3.18-96516-OSX.dmg

It seems https://update.virtualbox.org/query.php also works without SSL at http://update.virtualbox.org/query.php.

[jessepeterson]

.. and this does work (using HTTPS):

curl -v \
    -A 'VirtualBox 4.3.16 <macosx.64 [Product: Darwiease: 13.4.0 | Version: Darwin Kernel Version 13.4.0: Sun Aug 17 19:50:11 PDT 2014; root:xnu-2422.115.4~1/RELEASE_X86_64]>' \
    'https://update.virtualbox.org/query.php?platform=DARWIN_64BITS_GENERIC&version=4.3.16_95972&count=97&branch=stable'

As far as a strategy for possibly updating the URL Provider should we just use some statically coded values (like, e.g., the exact query strings and agent info above)? Whatchya'll think?

[timsutton]

Very nice. How did you manage to determine the valid query strings?

And I'd think just picking some static values makes sense. We can only go by intuition at this point, we don't know if they actually dynamically offer different OS X versions depending on the query. Since their support on OS X is so-so, I'm betting they don't manage multiple versions except perhaps very old legacy versions, which probably aren't of interest to AutoPkg'ers anyway.

[jessepeterson]

How did you manage to determine the valid query strings?

With full expectation it wouldn't work I hex-edited the dylib to contain the URL with http instead of https and then captured the resulting (unencrypted) network traffic. Turns out it worked, and the above queries were what went down.

I'd think just picking some static values makes sense.

Roger that, when I get some time I'll make the URLProvider use the above.

[jessepeterson]

Just for reference the VirtualBox source code for checking updates is here: https://www.virtualbox.org/browser/vbox/trunk/src/VBox/Frontends/VirtualBox/src/net/UIUpdateManager.cpp