[wp-meta] [Making WordPress.org] #2648: Cached downloads of ZIP files are making it impossible to update plugins

[Making WordPress.org]

#2648: Cached downloads of ZIP files are making it impossible to update plugins
------------------------------+-----------------------------------
 Reporter:  Otto42            |      Owner:
     Type:  defect            |     Status:  new
 Priority:  highest omg bbq   |  Milestone:  Plugin Directory v3.0
Component:  Plugin Directory  |   Keywords:
------------------------------+-----------------------------------
 If you download a ZIP file created since the new plugin directory went
 into effect, you get different results if you're logged in to
 WordPress.org or not.

 {{{
 ~$ curl --head https://downloads.wordpress.org/plugin/fv-wordpress-
 flowplayer.zip
 HTTP/1.1 200 OK
 Server: nginx
 Date: Thu, 30 Mar 2017 14:55:20 GMT
 Content-Type: application/octet-stream
 Content-Length: 2019961
 Connection: keep-alive
 Content-Disposition: attachment; filename=fv-wordpress-flowplayer.zip
 Last-Modified: Wed, 15 Mar 2017 15:58:46 GMT
 Cache-Control: max-age=604800
 X-Frame-Options: SAMEORIGIN
 X-nc: HIT lax 202
 Accept-Ranges: bytes
 }}}

 This serves up the wrong file. Note the HIT to the cache, as well as the
 last-modified date being March 15. The ZIP downloaded here is an older
 version, 6.0.5.21 instead of an updated version made on the 29th.
 Downloading the ZIP through a browser, logged into the site, gives you the
 correct version.

 This may also be interfering with download stats if the request is not
 passing through to the site.

 Because this only happens to "anonymous" hits, WordPress sites likely
 cannot receive plugin updates at this time. They get the old ZIP files and
 thus don't get the new updates. Updates never work, they always show as
 being available for that plugin.

--
Ticket URL: <https://meta.trac.wordpress.org/ticket/2648>
Making WordPress.org <https://meta.trac.wordpress.org/>
Making WordPress.org