mirror of
https://github.com/go-gitea/gitea.git
synced 2026-03-12 02:24:21 -05:00
Package registry: large packages download with size of 0B #9317
Closed
opened 2025-11-02 08:35:06 -06:00 by GiteaMirror
·
14 comments
No Branch/Tag Specified
main
release/v1.25
release/v1.24
release/v1.23
release/v1.22
release/v1.21
release/v1.20
release/v1.19
release/v1.18
release/v1.17
release/v1.16
release/v1.15
release/v1.14
release/v1.13
release/v1.12
release/v1.11
release/v1.10
release/v1.9
release/v1.8
v1.25.3
v1.25.2
v1.25.1
v1.25.0
v1.24.7
v1.25.0-rc0
v1.26.0-dev
v1.24.6
v1.24.5
v1.24.4
v1.24.3
v1.24.2
v1.24.1
v1.24.0
v1.23.8
v1.24.0-rc0
v1.25.0-dev
v1.23.7
v1.23.6
v1.23.5
v1.23.4
v1.23.3
v1.23.2
v1.23.1
v1.23.0
v1.23.0-rc0
v1.24.0-dev
v1.22.6
v1.22.5
v1.22.4
v1.22.3
v1.22.2
v1.22.1
v1.22.0
v1.23.0-dev
v1.22.0-rc1
v1.21.11
v1.22.0-rc0
v1.21.10
v1.21.9
v1.21.8
v1.21.7
v1.21.6
v1.21.5
v1.21.4
v1.21.3
v1.21.2
v1.20.6
v1.21.1
v1.21.0
v1.21.0-rc2
v1.21.0-rc1
v1.20.5
v1.22.0-dev
v1.21.0-rc0
v1.20.4
v1.20.3
v1.20.2
v1.20.1
v1.20.0
v1.19.4
v1.21.0-dev
v1.20.0-rc2
v1.20.0-rc1
v1.20.0-rc0
v1.19.3
v1.19.2
v1.19.1
v1.19.0
v1.19.0-rc1
v1.20.0-dev
v1.19.0-rc0
v1.18.5
v1.18.4
v1.18.3
v1.18.2
v1.18.1
v1.18.0
v1.17.4
v1.18.0-rc1
v1.19.0-dev
v1.18.0-rc0
v1.17.3
v1.17.2
v1.17.1
v1.17.0
v1.17.0-rc2
v1.16.9
v1.17.0-rc1
v1.18.0-dev
v1.16.8
v1.16.7
v1.16.6
v1.16.5
v1.16.4
v1.16.3
v1.16.2
v1.16.1
v1.16.0
v1.15.11
v1.17.0-dev
v1.16.0-rc1
v1.15.10
v1.15.9
v1.15.8
v1.15.7
v1.15.6
v1.15.5
v1.15.4
v1.15.3
v1.15.2
v1.15.1
v1.14.7
v1.15.0
v1.15.0-rc3
v1.14.6
v1.15.0-rc2
v1.14.5
v1.16.0-dev
v1.15.0-rc1
v1.14.4
v1.14.3
v1.14.2
v1.14.1
v1.14.0
v1.13.7
v1.14.0-rc2
v1.13.6
v1.13.5
v1.14.0-rc1
v1.15.0-dev
v1.13.4
v1.13.3
v1.13.2
v1.13.1
v1.13.0
v1.12.6
v1.13.0-rc2
v1.14.0-dev
v1.13.0-rc1
v1.12.5
v1.12.4
v1.12.3
v1.12.2
v1.12.1
v1.11.8
v1.12.0
v1.11.7
v1.12.0-rc2
v1.11.6
v1.12.0-rc1
v1.13.0-dev
v1.11.5
v1.11.4
v1.11.3
v1.10.6
v1.12.0-dev
v1.11.2
v1.10.5
v1.11.1
v1.10.4
v1.11.0
v1.11.0-rc2
v1.10.3
v1.11.0-rc1
v1.10.2
v1.10.1
v1.10.0
v1.9.6
v1.9.5
v1.10.0-rc2
v1.11.0-dev
v1.10.0-rc1
v1.9.4
v1.9.3
v1.9.2
v1.9.1
v1.9.0
v1.9.0-rc2
v1.10.0-dev
v1.9.0-rc1
v1.8.3
v1.8.2
v1.8.1
v1.8.0
v1.8.0-rc3
v1.7.6
v1.8.0-rc2
v1.7.5
v1.8.0-rc1
v1.9.0-dev
v1.7.4
v1.7.3
v1.7.2
v1.7.1
v1.7.0
v1.7.0-rc3
v1.6.4
v1.7.0-rc2
v1.6.3
v1.7.0-rc1
v1.7.0-dev
v1.6.2
v1.6.1
v1.6.0
v1.6.0-rc2
v1.5.3
v1.6.0-rc1
v1.6.0-dev
v1.5.2
v1.5.1
v1.5.0
v1.5.0-rc2
v1.5.0-rc1
v1.5.0-dev
v1.4.3
v1.4.2
v1.4.1
v1.4.0
v1.4.0-rc3
v1.4.0-rc2
v1.3.3
v1.4.0-rc1
v1.3.2
v1.3.1
v1.3.0
v1.3.0-rc2
v1.3.0-rc1
v1.2.3
v1.2.2
v1.2.1
v1.2.0
v1.2.0-rc3
v1.2.0-rc2
v1.1.4
v1.2.0-rc1
v1.1.3
v1.1.2
v1.1.1
v1.1.0
v1.0.2
v1.0.1
v1.0.0
v0.9.99
Labels
Clear labels
$20
$250
$50
$500
backport/done
💎 Bounty
docs-update-needed
good first issue
hacktoberfest
issue/bounty
issue/confirmed
issue/critical
issue/duplicate
issue/needs-feedback
issue/not-a-bug
issue/regression
issue/stale
issue/workaround
lgtm/need 2
modifies/api
modifies/translation
outdated/backport/v1.18
outdated/theme/markdown
outdated/theme/timetracker
performance/bigrepo
performance/cpu
performance/memory
performance/speed
pr/breaking
proposal/accepted
proposal/rejected
pr/wip
pull-request
reviewed/wontfix
💰 Rewarded
skip-changelog
status/blocked
topic/accessibility
topic/api
topic/authentication
topic/build
topic/code-linting
topic/commit-signing
topic/content-rendering
topic/deployment
topic/distribution
topic/federation
topic/gitea-actions
topic/issues
topic/lfs
topic/mobile
topic/moderation
topic/packages
topic/pr
topic/projects
topic/repo
topic/repo-migration
topic/security
topic/theme
topic/ui
topic/ui-interaction
topic/ux
topic/webhooks
topic/wiki
type/bug
type/deprecation
type/docs
type/enhancement
type/feature
type/miscellaneous
type/proposal
type/question
type/refactoring
type/summary
type/testing
type/upstream
Mirrored from GitHub Pull Request
Milestone
No items
No Milestone
Projects
Clear projects
No project
No Assignees
Notifications
Due Date
No due date set.
Dependencies
No dependencies set.
Reference: github-starred/gitea#9317
Reference in New Issue
Block a user
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Delete Branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @dorianim on GitHub (Aug 1, 2022).
Description
When uploading a package to the generic registry, the size is correctly stated in the UI:

When downloading it, however, it has a size of 0B:

Gitea logs:
2022/08/01 23:21:08 [62e843c4] router: completed GET /bluerock/-/packages/generic/app/0-preview-2f3f0488da9755d3e1378fd33d95aceec86a1058/files/160 for 46.114.95.2:0, 0 in 25.2ms @ user/package.go:370(user.DownloadPackageFile)Gitea Version
1.17.0
Can you reproduce the bug on the Gitea demo site?
No, maybe because it is on
1.18.0+dev-198-g4f14c6de1?How are you running Gitea?
I am using the
gitea/giteadocker image on thelatesttagDatabase
PostgreSQL
@wxiaoguang commented on GitHub (Aug 2, 2022):
Are you using any reverse-proxy, or can you try to download the file from Gitea HTTP port directly? The content-length header doesn't seem to be generated by Gitea.
@dorianim commented on GitHub (Aug 2, 2022):
Thanks for your reply! Unfortunately, this does not seem to be the reason.
My instance is indeed running behind a trafik reverse proxy, but when curling it directly, the content length header still exists and is 0:
@wxiaoguang commented on GitHub (Aug 2, 2022):
I guess the problem is that the uploaded file was empty already. There is a bug when uploading packages.
When a large package is uploaded, the
pfci.Datais already EOF beforecontentStore.Save, so there will an empty file saved in the store.@KN4CK3R
If I add a
pfci.Data.(*packages_module.HashedBuffer).Seek(0, io.SeekStart)beforeif err := contentStore.Save(packages_module.BlobHash256Key(pb.HashSHA256), pfci.Data, pfci.Data.Size()); err != nil {inaddFileToPackageVersion, then the problem is resolved.@KN4CK3R commented on GitHub (Aug 2, 2022):
That should not be EOF. My old test upload does not have a problem. I will have a look.
Edit: The error occurs only with larger files which are temporarly stored on the filesystem, so my
FileBackedBuffermay be broken.@KN4CK3R commented on GitHub (Aug 2, 2022):
Fixed with #20622
@dorianim commented on GitHub (Aug 2, 2022):
Thanks for the quick fix!
In which version will this be released?
@wxiaoguang commented on GitHub (Aug 2, 2022):
Now it on 1.18-dev
There will be a backport for 1.17.1
@KN4CK3R commented on GitHub (Aug 2, 2022):
Backport in #20635
@f403 commented on GitHub (Oct 11, 2022):
I fear, this is not solved, or there is another bug.
When uploading very big files (in my case 1.4G) they do not appear on disk, and downloading results in a 0B size.
Without any warnings during upload/download.
Gitea 1.17.2 (docker)
Steps to reproduce:
And the logs at this time:
And there no new files on disk:
@KN4CK3R commented on GitHub (Oct 11, 2022):
Do you use a reverse proxy?
Tested it with a 1.5gb file and it worked without problems.
@f403 commented on GitHub (Oct 11, 2022):
Yes, but same happens when uploading without proxy.
@f403 commented on GitHub (Oct 11, 2022):
Hmm...
It worked in a fresh container on my laptop.
Can you, please, give me a hint, where to look for the uploaded files (temp path, disk path for a certain package file)?
@KN4CK3R commented on GitHub (Oct 11, 2022):
When uploading files larger 32mb the content gets temporarly stored in
%temp%/gitea-buffer-xxxwith%temp%whatever is the temporary directory of the current user andxxxsome random characters.And the file is then stored in
data/packages/xxxby default. This can be changed in theapp.ini.xxxis a path depeding of the file sha256 hash.@f403 commented on GitHub (Oct 11, 2022):
Thank you!
There was an empty file under
data/packages/xxxcreated before updating to 1.17.2.Deleting the file and restarting Gitea helped. (And running "Cleanup expired packages", not sure if it was needed)
(Not overwriting existing files is correct, otherwise there is a possibility for a hash-collision attack)