Curl returns `000` http status codes on successful download

[fasmat]

Curl returns `000` http status codes on successful download

[shamil-mubarakshin]

Its 8.4.0 when run from pwsh and 8.8.0 when run from bash

[kzantow]

This is also affecting https://github.com/anchore/sbom-action

[fasmat]

Quick update: the reason for the 000 status code seems to be the fact that the file is downloaded to a temporary file created with mktemp:

# this prints 000
tmp=$(mktemp)
curl -w '%{http_code}' -sL -H 'Accept:application/json' -o "$tmp" https://github.com/golangci/golangci-lint/releases/v1.57.0 

# this prints 200
curl -w '%{http_code}' -sL -H 'Accept:application/json' -o test.json https://github.com/golangci/golangci-lint/releases/v1.57.0

I'm not fully understanding why id did work on the previous version and not this one though 🤷

[shamil-mubarakshin]

Hey @fasmat, There seems to be a bug in curl v8.8.0 (which is shipped with git-for-windows v2.45.2) when used with --write-output. It is discussed in curl/curl#13845 and will probably make it to their next release

[fasmat]

Thanks for the response @shamil-mubarakshin

I hope that's the issue that we are experiencing. The curl version on the runner seems to be a different version:

curl --version
curl 8.4.0 (Windows) libcurl/8.4.0 Schannel WinIDN

But the observed issue seems to be the same 🤔

[ijunaidm]

@fasmat - Issue is with curl , lets wait and get the curl issue curl/curl#13845 gets fixed . Hence I am closing this issue.

[fasmat]

Is there any way to roll back the git that is installed on the runners? not only does it break curl it also causes regular issues with checking out our repository when building our source:

https://github.com/spacemeshos/go-spacemesh/actions/runs/9577708148/job/26406459251?pr=6049

These are recent issues that we didn't have a few weeks ago.

[kzantow]

Out of curiosity, why was this issue closed? The issue is in curl, but it's in a version of curl that is currently in the windows runners. Here is a workflow exhibiting the issue with curl 8.8.0 and showing that the older version, 8.7.1 does not have the problem: https://github.com/kzantow-anchore/sbom-action-test/actions/runs/9860639787/job/27227290279
Note that the default curl fails.

    runs-on: windows-latest
    steps:
      - run: sh -c 'curl -sSfL https://raw.githubusercontent.com/anchore/syft/main/install.sh > $(pwd)/install.sh'
      - run: |
          md curl
          curl https://curl.se/windows/dl-8.7.1_3/curl-8.7.1_3-win64-mingw.zip > curl/curl.zip
          cd curl
          unzip curl.zip
      - run: sh -c 'PATH="$(pwd)/curl/curl-8.7.1_3-win64-mingw/bin:$PATH" curl --version'
      - run: sh -c 'PATH="$(pwd)/curl/curl-8.7.1_3-win64-mingw/bin:$PATH" sh $(pwd)/install.sh -b curl-8.7.1'
      - run: sh -c 'curl-8.7.1/syft version'

      - run: sh -c 'curl --version'
      - run: sh -c 'sh $(pwd)/install.sh -b curl-8.8.0'
      - run: sh -c 'curl-8.8.0/syft version'