flash-it 403 error on rootfs for Pinephone 1.2

[vandys]

• wget -q --show-progress -O u-boot.zip https://github.com/sailfish-on-dontbeevil/u-boot-bootloader/releases/download/v0.9/u-boot-pinephone
  u-boot.zip 100%[===================>] 3.56M 2.49MB/s in 1.4s
• UBOOT_DOWNLOAD2='https://gitlab.com/pine64-org/crust-meta/-/jobs/artifacts/master/raw/u-boot-sunxi-with-spl-pinephone.bin?job=build'
• wget -q --show-progress -O u-boot-sunxi-with-spl-pinephone.bin 'https://gitlab.com/pine64-org/crust-meta/-/jobs/artifacts/master/raw/u-boot-sunxi-with-spl-pinephone.bin?job=build'
  u-boot-sunxi-with-s 100%[===================>] 740.44K 2.38MB/s in 0.3s
• ROOTFS_DOWNLOAD='https://gitlab.com/sailfishos-porters-ci/dont_be_evil-ci/-/jobs/artifacts/master/download?job=pinephone-1.1-rootfs'
• wget -q --show-progress -O pinephone-1.1-rootfs.zip 'https://gitlab.com/sailfishos-porters-ci/dont_be_evil-ci/-/jobs/artifacts/master/download?job=pinephone-1.1-rootfs'
• echo 'Root filesystem image download failed. Aborting.'
  Root filesystem image download failed. Aborting.
• exit 2

Detailed failure:

pi20$ wget 'https://gitlab.com/sailfishos-porters-ci/dont_be_evil-ci/-/jobs/artifacts/master/download?job=pinephone-1.1-rootfs'
--2022-12-21 07:36:09-- https://gitlab.com/sailfishos-porters-ci/dont_be_evil-ci/-/jobs/artifacts/master/download?job=pinephone-1.1-rootfs
Resolving gitlab.com (gitlab.com)... 172.65.251.78, 2606:4700:90:0:f22e:fbec:5bed:a9b9
Connecting to gitlab.com (gitlab.com)|172.65.251.78|:443... connected.
HTTP request sent, awaiting response... 302 Found
Location: https://gitlab.com/sailfishos-porters-ci/dont_be_evil-ci/-/jobs/3492759419/artifacts/download [following]
--2022-12-21 07:36:10-- https://gitlab.com/sailfishos-porters-ci/dont_be_evil-ci/-/jobs/3492759419/artifacts/download
Reusing existing connection to gitlab.com:443.
HTTP request sent, awaiting response... 302 Found
Location: https://cdn.artifacts.gitlab-static.net/95/af/95afef4491db0fadb6db22d1447af705ff00bf54177433cfe0a4573721b859ba/2022_12_18/3492759419/3816730035/artifacts.zip?response-content-disposition=attachment%3B%20filename%3D%22artifacts.zip%22%3B%20filename%2A%3DUTF-8%27%27artifacts.zip&response-content-type=application%2Fzip&Expires=1671637570&KeyName=gprd-artifacts-cdn&Signature=4BJ0H_0_YFabVJ5ZG76SzVsOMFI= [following]
--2022-12-21 07:36:10-- https://cdn.artifacts.gitlab-static.net/95/af/95afef4491db0fadb6db22d1447af705ff00bf54177433cfe0a4573721b859ba/2022_12_18/3492759419/3816730035/artifacts.zip?response-content-disposition=attachment%3B%20filename%3D%22artifacts.zip%22%3B%20filename*%3DUTF-8''artifacts.zip&response-content-type=application%2Fzip&Expires=1671637570&KeyName=gprd-artifacts-cdn&Signature=4BJ0H_0_YFabVJ5ZG76SzVsOMFI=
Resolving cdn.artifacts.gitlab-static.net (cdn.artifacts.gitlab-static.net)... 34.110.204.38
Connecting to cdn.artifacts.gitlab-static.net (cdn.artifacts.gitlab-static.net)|34.110.204.38|:443... connected.
HTTP request sent, awaiting response... 403 Forbidden
2022-12-21 07:36:10 ERROR 403: Forbidden.

[piggz]

Hi
Thanks for the report.I discussed the same issue with someone else recently, and we couldnt figure it out. The URL downloaded fine for him in firefox, and also using flash-it on another PC. There should be 2x 302 redirects and then a 200ok, but you are getting a 403. Have you any ideas?

[vandys]

It has to be a User-Agent flakiness; I did manage to pull it with links, but "-U links" from wget still didn't fix it. So maybe some bright light inside Github has a faily complex UA dissector. Why they'd want to sabotage wget is beyond me, but now that I know it's not something dumb on my part, I'll go fiddle with it some more.

[vandys]

Looks like wget 1.21.3 doesn't quote "" in URL arguments, 1.20.1 does. So the ultimate fetched URL in the former has a naked "" in the URL, the latter quotes it to %2A. I'm going to go cook up a 1.20.1 for my newer system and verify...

[piggz]

Oh, thanks for the research. Happy to accept a PR to fix it too :)

[vandys]

So it's not the wget version, it looks like it's a bug in iconv() in the libc of the system. I replaced the use of wget with curl (skipping progress option, since it always has it, adding -L to follow redirects, and -O becomes --output). Looks like that built an sdcard for me! TBD if you want to move from a wget dependency to a curl one?

[piggz]

I guess it depends how many other users it will hit? What OS is this on? Ive not had it, and afaik, only you and one other person :)

[vandys]

It was easy to patch the bash script, no problem there. It's Debian bookworm/sid. (arm64, though I doubt that matters.)