Curl returns 000 http status codes on successful download

[fasmat]

Description

Our CI involves installing golangci-lint using the official install.sh script. Up until version 20240514.3.0 it worked perfectly fine on the windows-2022 runner, but starting with 20240603.1.0 we see failures during that step:

• last successful run: https://github.com/spacemeshos/go-spacemesh/actions/runs/9401526334/job/25893520036
• first failing run: https://github.com/spacemeshos/go-spacemesh/actions/runs/9401995087/job/25895032574

I added debug logging and investigated a bit. The download on ubuntu-22.04 produces this output:

curl -sL -o test.txt "https://github.com/golangci/golangci-lint/releases/v1.57.0" -H "Accept:application/json" || (echo "command failed $?"; sh -c 'exit 1')
cat test.txt
{"id":147333011,"tag_name":"v1.57.0","update_url":"/golangci/golangci-lint/releases/tag/v1.57.0","update_authenticity_token":"nAwL2kcAQUHtjrMeooMgnLww_xeC4A1k5WoczU7v4tZOVLGwOzrj8cz0Xioufw76jE4ndi6KiUEbFhdHxmehWg","delete_url":"/golangci/golangci-lint/releases/tag/v1.57.0","delete_authenticity_token":"zbFguiORQue6ycdDAq1RLLmoFhAQcXkBRtnjrJykMsqYqwiWx4l6Xc_QSGM_bJxGZfhri3U3E7fQE2Mr9gcOlw","edit_url":"/golangci/golangci-lint/releases/edit/v1.57.0"}
...
curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh | sh -s -- -d v1.57.0
golangci/golangci-lint info checking GitHub for tag 'v1.57.0'
golangci/golangci-lint debug http_download https://github.com/golangci/golangci-lint/releases/v1.57.0
golangci/golangci-lint info found version: 1.57.0 for v1.57.0/darwin/arm64
golangci/golangci-lint debug downloading files into /var/folders/bl/vp13x8dd5kb94j4t9vz0h1_80000gn/T/tmp.woS1Tw1M
golangci/golangci-lint debug http_download https://github.com/golangci/golangci-lint/releases/download/v1.57.0/golangci-lint-1.57.0-darwin-arm64.tar.gz
golangci/golangci-lint debug http_download https://github.com/golangci/golangci-lint/releases/download/v1.57.0/golangci-lint-1.57.0-checksums.txt
golangci/golangci-lint info installed ./bin/golangci-lint

on windows-2022 however it produces this:

curl -sL -o test.txt "https://github.com/golangci/golangci-lint/releases/v1.57.0" -H "Accept:application/json" || (echo "command failed $?"; sh -c 'exit 1')
cat test.txt
{"id":147333011,"tag_name":"v1.57.0","update_url":"/golangci/golangci-lint/releases/tag/v1.57.0","update_authenticity_token":"s0ROCVwIJTg95FqhH2ycFDrHkDxLkzblL7xP8WIl3rXPSLMS8qMUcp5HPSieazhdpuFp0uUGnTZYw2GuoaBjaA","delete_url":"/golangci/golangci-lint/releases/tag/v1.57.0","delete_authenticity_token":"TWP_CjPRKqKlTHL4ey29WE4zrwclCpk1UsUXV5O0ltfKNQhRzPXV2kJoQv_lAqw8IhxwxGo-FA9LLrDQKgO6Ag","edit_url":"/golangci/golangci-lint/releases/edit/v1.57.0"}
...
curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh | sh -s -- -d v1.57.0
golangci/golangci-lint info checking GitHub for tag 'v1.57.0'
golangci/golangci-lint debug http_download https://github.com/golangci/golangci-lint/releases/v1.57.0
golangci/golangci-lint debug http_download_curl received HTTP status 000
golangci/golangci-lint crit unable to find 'v1.57.0' - use 'latest' or see https://github.com/golangci/golangci-lint/releases for details

The reason for the installation failures seem to be caused by the script checking the returned http header and although the http request was successful and produces the same json as on other runners on windows-2022 for some reason the http response returns the status code 000 instead of 200 causing the install.sh script to fail and the workflow to abort with an error.

Platforms affected

• Azure DevOps
• GitHub Actions - Standard Runners
• GitHub Actions - Larger Runners

Runner images affected

• Ubuntu 20.04
• Ubuntu 22.04
• Ubuntu 24.04
• macOS 11
• macOS 12
• macOS 13
• macOS 13 Arm64
• macOS 14
• macOS 14 Arm64
• Windows Server 2019
• Windows Server 2022

Image version and build link

20240603.1.0

latest CI run with debugging enabled and some extra steps showing the problem: https://github.com/spacemeshos/go-spacemesh/actions/runs/9415941492/job/25938011887

Is it regression?

20240514.3.0 worked perfectly fine - https://github.com/spacemeshos/go-spacemesh/actions/runs/9401526334/job/25893520036

Expected behavior

Curl should not return 000 as http status code on a successful request.

Actual behavior

It seems curl behaves incorrectly in the newest runner image for windows 2022

Repro steps

See decription above

[kzantow]

This is also affecting https://github.com/anchore/sbom-action

[fasmat]

Quick update: the reason for the 000 status code seems to be the fact that the file is downloaded to a temporary file created with mktemp:

# this prints 000
tmp=$(mktemp)
curl -w '%{http_code}' -sL -H 'Accept:application/json' -o "$tmp" https://github.com/golangci/golangci-lint/releases/v1.57.0 

# this prints 200
curl -w '%{http_code}' -sL -H 'Accept:application/json' -o test.json https://github.com/golangci/golangci-lint/releases/v1.57.0

I'm not fully understanding why id did work on the previous version and not this one though 🤷

[shamil-mubarakshin]

Hey @fasmat, There seems to be a bug in curl v8.8.0 (which is shipped with git-for-windows v2.45.2) when used with --write-output. It is discussed in curl/curl#13845 and will probably make it to their next release

[fasmat]

Thanks for the response @shamil-mubarakshin

I hope that's the issue that we are experiencing. The curl version on the runner seems to be a different version:

curl --version
curl 8.4.0 (Windows) libcurl/8.4.0 Schannel WinIDN

But the observed issue seems to be the same 🤔

[shamil-mubarakshin]

Its 8.4.0 when run from pwsh and 8.8.0 when run from bash

[ijunaidm]

@fasmat - Issue is with curl , lets wait and get the curl issue curl/curl#13845 gets fixed . Hence I am closing this issue.

[fasmat]

Is there any way to roll back the git that is installed on the runners? not only does it break curl it also causes regular issues with checking out our repository when building our source:

https://github.com/spacemeshos/go-spacemesh/actions/runs/9577708148/job/26406459251?pr=6049

These are recent issues that we didn't have a few weeks ago.

[kzantow]

Out of curiosity, why was this issue closed? The issue is in curl, but it's in a version of curl that is currently in the windows runners. Here is a workflow exhibiting the issue with curl 8.8.0 and showing that the older version, 8.7.1 does not have the problem: https://github.com/kzantow-anchore/sbom-action-test/actions/runs/9860639787/job/27227290279
Note that the default curl fails.

    runs-on: windows-latest
    steps:
      - run: sh -c 'curl -sSfL https://raw.githubusercontent.com/anchore/syft/main/install.sh > $(pwd)/install.sh'
      - run: |
          md curl
          curl https://curl.se/windows/dl-8.7.1_3/curl-8.7.1_3-win64-mingw.zip > curl/curl.zip
          cd curl
          unzip curl.zip
      - run: sh -c 'PATH="$(pwd)/curl/curl-8.7.1_3-win64-mingw/bin:$PATH" curl --version'
      - run: sh -c 'PATH="$(pwd)/curl/curl-8.7.1_3-win64-mingw/bin:$PATH" sh $(pwd)/install.sh -b curl-8.7.1'
      - run: sh -c 'curl-8.7.1/syft version'

      - run: sh -c 'curl --version'
      - run: sh -c 'sh $(pwd)/install.sh -b curl-8.8.0'
      - run: sh -c 'curl-8.8.0/syft version'

[faridahmed25]

runs-on: windows-latest
steps:
  - run: sh -c 'curl -sSfL https://raw.githubusercontent.com/anchore/syft/main/install.sh > $(pwd)/install.sh'
  - run: |
      md curl
      curl https://curl.se/windows/dl-8.7.1_3/curl-8.7.1_3-win64-mingw.zip > curl/curl.zip
      cd curl
      unzip curl.zip
  - run: sh -c 'PATH="$(pwd)/curl/curl-8.7.1_3-win64-mingw/bin:$PATH" curl --version'
  - run: sh -c 'PATH="$(pwd)/curl/curl-8.7.1_3-win64-mingw/bin:$PATH" sh $(pwd)/install.sh -b curl-8.7.1'
  - run: sh -c 'curl-8.7.1/syft version'

  - run: sh -c 'curl --version'
  - run: sh -c 'sh $(pwd)/install.sh -b curl-8.8.0'
  - run: sh -c 'curl-8.8.0/syft version'