Skip to content

feat: add CDN fallback for CLI binary downloads#88

Merged
sampras343 merged 1 commit into
mainfrom
SECURESIGN-2158-cdn-fallback
Jul 20, 2026
Merged

feat: add CDN fallback for CLI binary downloads#88
sampras343 merged 1 commit into
mainfrom
SECURESIGN-2158-cdn-fallback

Conversation

@sampras343

@sampras343 sampras343 commented Jul 20, 2026

Copy link
Copy Markdown
Member

Summary

Add a three-tier fallback chain to the openshift strategy for downloading CLI binaries from ConsoleCLIDownload URLs:

Tier Source When it works
1. Production developers.redhat.com/.../RHTAS/<version>/... Post-release (binaries published)
2. Staging developers.qa.redhat.com/... via squid proxy Pre-release from corporate network
3. CDN fallback access.cdn.redhat.com/... resolved from prod 1.4.1 Always (stable published version)

The CDN fallback resolves the direct download URL from the Developer Portal's 302 redirect (tcDownloadURL query parameter), bypassing the HTML interstitial page that blocks programmatic downloads.

Changes

  • pkg/strategy/openshift/openshift.go — three-tier fallback chain with version regex replacement and CDN resolution
  • pkg/support/testSupport.go — add ResolveCDNLink helper that extracts CDN URL from Developer Portal redirects

Verified locally against live cluster

--- Step 1: Production 1.5.0 ---
  Result: 400 Bad Request (not published)

--- Step 2: Staging (simulated unreachable) ---
  Result: DNS failure (no corporate network)

--- Step 3: CDN fallback (prod 1.4.1) ---
  CDN link: https://access.cdn.redhat.com/.../cosign_linux_amd64.tar.gz?_auth_=...
  PASS: binary at /tmp/cdn.../cosign

Implements SECURESIGN-2158

Add a three-tier fallback chain to the openshift strategy:
1. Production Developer Portal (current version)
2. Staging Developer Portal via squid proxy (pre-release binaries)
3. Stable CDN fallback (prod 1.4.1 via tcDownloadURL redirect)

The CDN fallback resolves the direct download URL from the Developer
Portal's 302 redirect, bypassing the HTML interstitial page. This
ensures E2E tests can always obtain CLI binaries regardless of
whether the target version is published or staging is accessible.

Also adds ResolveCDNLink helper to support package.

Implements SECURESIGN-2158

Signed-off-by: Sachin Sampras M <sampras343@gmail.com>
@sampras343
sampras343 merged commit 2273873 into main Jul 20, 2026
6 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants