Uncache downloads

[jssblck]

Overview

Updates install-latest.sh to disable caching during downloads.

Acceptance criteria

Downloads are not susceptible to overzealous caches.

Testing plan

We don't have tests in place for the installation script, so I was unable to rely on automated tests.

I applied the changes in Disable cache (cde442c) and in Add debug lines (8217bdd).

I ran a test manually:

❯ ./install-latest.sh
fossas/fossa-cli info checking GitHub for latest tag
fossas/fossa-cli info found fossa-cli 3.7.11 binary for linux/amd64 at https://github.com/fossas/fossa-cli/releases/download/v3.7.11/fossa_3.7.11_linux_amd64.tar.gz
fossas/fossa-cli info
fossas/fossa-cli info ------
fossas/fossa-cli info Notice
fossas/fossa-cli info ------
fossas/fossa-cli info
fossas/fossa-cli info FOSSA collects warnings, errors, and usage data to improve
fossas/fossa-cli info the FOSSA CLI and your experience.
fossas/fossa-cli info
fossas/fossa-cli info Read more: https://github.com/fossas/fossa-cli/blob/master/docs/telemetry.md
fossas/fossa-cli info
fossas/fossa-cli info If you want to prevent any telemetry data from being sent to
fossas/fossa-cli info the server, you can opt out of telemetry by setting
fossas/fossa-cli info FOSSA_TELEMETRY_SCOPE environment variable to 'off' in your shell.
fossas/fossa-cli info
fossas/fossa-cli info For example:
fossas/fossa-cli info    FOSSA_TELEMETRY_SCOPE=off fossa analyze
fossas/fossa-cli info
fossas/fossa-cli info
running: curl -w '%{HTTP_CODE}' -sL  -H Cache-Control: no-cache -o /tmp/tmp.c44Bt16oNb/fossa_3.7.11_linux_amd64.tar.gz https://github.com/fossas/fossa-cli/releases/download/v3.7.11/fossa_3.7.11_linux_amd64.tar.gz
running: curl -w '%{HTTP_CODE}' -sL  -H Cache-Control: no-cache -o /tmp/tmp.c44Bt16oNb/fossa_3.7.11_linux_amd64.tar.gz.sha256 https://github.com/fossas/fossa-cli/releases/download/v3.7.11/fossa_3.7.11_linux_amd64.tar.gz.sha256
fossas/fossa-cli info installed /usr/local/bin/fossa

I then applied Disable curl (f911423) and ran a test locally:

❯ ./install-latest.sh
fossas/fossa-cli info checking GitHub for latest tag
fossas/fossa-cli info found fossa-cli 3.7.11 binary for linux/amd64 at https://github.com/fossas/fossa-cli/releases/download/v3.7.11/fossa_3.7.11_linux_amd64.tar.gz
fossas/fossa-cli info
fossas/fossa-cli info ------
fossas/fossa-cli info Notice
fossas/fossa-cli info ------
fossas/fossa-cli info
fossas/fossa-cli info FOSSA collects warnings, errors, and usage data to improve
fossas/fossa-cli info the FOSSA CLI and your experience.
fossas/fossa-cli info
fossas/fossa-cli info Read more: https://github.com/fossas/fossa-cli/blob/master/docs/telemetry.md
fossas/fossa-cli info
fossas/fossa-cli info If you want to prevent any telemetry data from being sent to
fossas/fossa-cli info the server, you can opt out of telemetry by setting
fossas/fossa-cli info FOSSA_TELEMETRY_SCOPE environment variable to 'off' in your shell.
fossas/fossa-cli info
fossas/fossa-cli info For example:
fossas/fossa-cli info    FOSSA_TELEMETRY_SCOPE=off fossa analyze
fossas/fossa-cli info
fossas/fossa-cli info
running: wget -q  --no-cache --server-response -O /tmp/tmp.BZhJqTCtM9/fossa_3.7.11_linux_amd64.tar.gz https://github.com/fossas/fossa-cli/releases/download/v3.7.11/fossa_3.7.11_linux_amd64.tar.gz 2>&1 | awk 'NR==1{print https://github.com/fossas/fossa-cli/releases/download/v3.7.11/fossa_3.7.11_linux_amd64.tar.gz}'
running: wget -q  --no-cache --server-response -O /tmp/tmp.BZhJqTCtM9/fossa_3.7.11_linux_amd64.tar.gz.sha256 https://github.com/fossas/fossa-cli/releases/download/v3.7.11/fossa_3.7.11_linux_amd64.tar.gz.sha256 2>&1 | awk 'NR==1{print https://github.com/fossas/fossa-cli/releases/download/v3.7.11/fossa_3.7.11_linux_amd64.tar.gz.sha256}'
fossas/fossa-cli info installed /usr/local/bin/fossa

In all cases, fossa was successfully installed:

❯ fossa -V
fossa-cli version 3.7.11 (revision c90bf4b24f41 compiled with ghc-9.0)

I then reverted the Disable curl and Add debug lines commits.

Risks

This could result in increased network traffic in organizations that rely on caches to minimize network usage or in CI runs. I think on the balance this is probably worthwhile, since any organization that must have aggressive caching is likely doing so manually or using servers that ignore cache control headers anyway.

References

https://fossa.zendesk.com/agent/tickets/6371

Checklist

• I added tests for this PR's change (or explained in the PR description why tests don't make sense).
• If this PR introduced a user-visible change, I added documentation into docs/.
• If this change is externally visible, I updated Changelog.md. If this PR did not mark a release, I added my changes into an # Unreleased section at the top.
• If I made changes to .fossa.yml or fossa-deps.{json.yml}, I updated docs/references/files/*.schema.json. You may also need to update these if you have added/removed new dependency type (e.g. pip) or analysis target type (e.g. poetry).

[zlav]

LGTM and I agree with your points about caching. I think anyone caching aggressively would rather manage it themselves.