Www.julialang.org: Checksums files for 1.0.5 returning 403

[tianon]

Sometime in the last ~12 hours it appears something changed with respect to the checksum files for the 1.0.5 release such that they now 403. Links from https://julialang.org/downloads/:

• https://julialang-s3.julialang.org/bin/checksums/julia-1.0.5.md5
• https://julialang-s3.julialang.org/bin/checksums/julia-1.0.5.sha256

$ curl -fsSL 'https://julialang-s3.julialang.org/bin/checksums/julia-1.0.5.md5'
curl: (22) The requested URL returned error: 403 
$ curl -fsSL 'https://julialang-s3.julialang.org/bin/checksums/julia-1.0.5.sha256'
curl: (22) The requested URL returned error: 403 

(Apologies if this isn't the right place to report this! Happy to be redirected elsewhere. :innocent: :heart:)

[ararslan]

Thanks for the report! Looks like the permissions for those files weren't correctly set to public read access. I've fixed that, and things seem to work now. Let me know if you run into any more issues!

[tianon]

Looks like this is happening again now as of sometime between Feb 17th and Feb 21st (sorry I don't have more detailed records between those) -- any idea what might have caused a resurgence of it? :sweat_smile:

[ararslan]

That is very bizarre. @staticfloat, any ideas?

[tianon]

Oh, this is for a different version, specifically 1.3.1:

• https://julialang-s3.julialang.org/bin/checksums/julia-1.3.1.sha256

[fredrikekre]

For 1.0.5? Both links in the OP work for me.

[tianon]

Yeah sorry, 1.0.5 is fine, but 1.3.1 is now not. :sweat_smile:

(I was reading my logs wrong :see_no_evil: :innocent:)

[ararslan]

Ah yeah, the permissions were wrong for 1.3.1. Sorry about that. I've just fixed it.

[tianon]

Awesome, thanks so much, @ararslan! :+1: :heart:

(and sorry for the confusion caused by my misreading my logs :man_facepalming:)

[ararslan]

No worries, thanks for reporting the issue!

[ViralBShah]

@tianon is this from some kind of CI script? Just curious.

[tianon]

@ViralBShah yeah! for https://hub.docker.com/_/julia, we embed the SHA256 value directly in the Dockerfile for a given version (so it can verify the artifacts after downloading), and we've got a Jenkins job that periodically scrapes for new versions and embeds the SHA256, so it fails when the SHA file isn't accessible :sweat_smile:

[tianon]

It looks like this might've happened again on 1.5.3? :innocent: :heart:

https://julialang-s3.julialang.org/bin/checksums/julia-1.5.3.sha256 -> AccessDenied / 403.

[staticfloat]

Fixed. That's gonna be a bug report to the cyberduck team (editing the file using its internal "edit" functionality cleared its permissions). ;)

EDIT: upstream ticket: https://trac.cyberduck.io/ticket/11510#ticket