Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Runtime hashes reports "Invalid version" for 6.0.6 #6

Open
NotNite opened this issue Jun 8, 2023 · 0 comments
Open

Runtime hashes reports "Invalid version" for 6.0.6 #6

NotNite opened this issue Jun 8, 2023 · 0 comments

Comments

@NotNite
Copy link

NotNite commented Jun 8, 2023

Observe the start of ReleaseController.Runtime:

[HttpGet("{kind}/{version}")]
public async Task<IActionResult> Runtime(string version, string kind)
{
    if (this.releaseCache.HasFailed && this.releaseCache.Get()?.DalamudVersions == null)
        return StatusCode(500, "Precondition failed");

    if (this.releaseCache.Get()!.DalamudVersions.All(x => x.Value.RuntimeVersion != version) && version != "5.0.6")
        return this.BadRequest("Invalid version");

This is special-cased for the runtime version originally shipped (5.0.6), and looks up if any current Dalamud version is using this runtime version (I think?). However, this is flawed, as XL will make this request with the local runtime/version file, which may be a version no longer (but previously) used by Dalamud (6.0.6, in this scenario). This resulted in a user unable to update Dalamud, as DalamudUpdater was failing in DalamudUpdater.CheckRuntimeHashes.

The hashes are still present in dalamud-distrib, so it doesn't make much sense to throw here. I propose one of

  • attempt the request to dalamud-distrib and then 400 if it fails, noting the file does not exist
  • create a metadata file in dalamud-distrib containing a list of version with hashes, which is then cached (prevents a bad actor from spamming invalid version numbers which get proxied to GitHub)
  • remove the runtime folder if the request 400's in XL
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant