Skip to content

Allow sessionless users to download releases

Allen Cook requested to merge 375489-download-install-gitlab-release-binary-via-private-homebrew-tap into master

What does this MR do and why?

Allows release files to be downloaded from private projects with access tokens

Screenshots or screen recordings

Screenshots are required for UI changes, and strongly recommended for all other merge requests.

How to set up and validate locally

  1. Enable the feature flag Feature.enable(:allow_release_as_web_access_format)
  2. Setup a private project with a release
  3. Add a release binary to that release with the API (/api/v4/projects/PROJ_ID/releases/REL_NAME/assets/links with a body describing the new release. { "name": "linkname","url": "URL", "filepath": "link.zip" }
  4. The response should contain direct_asset_url, copy that for the next step
  5. Get the direct_asset_url using an access token (i.e. curl --request GET --url 'direct_asset_url' --header 'Authorization: Bearer TOKEN')
  6. You should see a response redirecting you to the original URL

MR acceptance checklist

This checklist encourages us to confirm any changes have been analyzed to reduce risks in quality, performance, reliability, security, and maintainability.

Related to #375489 (closed)

Edited by Allen Cook

Merge request reports