[ganto]

Summary

tryMirrors followed only one redirect per mirror attempt. A second redirect (as Fedora COPR sends) reached the client as a 3xx, and the package never got cached.

 tryMirrors
   for each mirror, attempt
     rsp = forward(mirror URL)
-    if rsp is redirect
-      rsp = forward(Location)
+    for hop := 0; rsp is redirect; hop++
+      if hop == 10                      -> fail attempt, next mirror
+      if https -> http downgrade        -> fail attempt, next mirror
+      rsp = forward(Location)
     if rsp is 200 -> return

If every mirror fails this way the client gets 502 Bad Gateway, never a 3xx. New spec: openspec/specs/upstream-redirects/spec.md.

Evidence

• Before: (new tests run against main's proxy.go)

  --- FAIL: TestForwardProxyMultiHopRedirect
  --- FAIL: TestForwardProxyRedirectLoop
  --- FAIL: TestForwardProxyRedirectExactlyMaxHops
  --- FAIL: TestForwardProxyRedirectHTTPSDowngradeRejected
  

  After:

  --- PASS: TestForwardProxyRedirect
  --- PASS: TestForwardProxyMultipleRedirectStatusCodes
  --- PASS: TestForwardProxyRetryAfterRedirect5xx
  --- PASS: TestForwardProxyMultiHopRedirect
  --- PASS: TestForwardProxyRedirectLoop
  --- PASS: TestForwardProxyRedirectExactlyMaxHops
  --- PASS: TestForwardProxyRedirectLimitFallsBackToNextMirror
  --- PASS: TestForwardProxyRedirectHTTPSDowngradeRejected
  

Merge Danger

Door: two-way

Change is local to tryMirrors. No config or cache format changes; a revert restores the old behavior.

Blast Radius: upstream-fetching

A mirror that redirects from HTTPS to HTTP now fails instead of being followed. The proxy then tries the next mirror, or returns 502 if none is left.

🤖 Generated with Claude Code