search

iBotPeaches / Apktool

A tool for reverse engineering Android apk files
https://apktool.org/
Apache License 2.0
19.96k stars 3.57k forks source link

BitBucket download links are broken #2716

Closed aburaksahin closed 2 years ago

aburaksahin commented 2 years ago

Hi Connor,

I'd like to download apktool as a jar, but links are broken in the bitbucket repo. I'm receiving ERR_CERT_INVALID error. Could you please fix it?

https://bitbucket.org/iBotPeaches/apktool/downloads/

Thanks.

iBotPeaches commented 2 years ago 
➜  ~ curl -I https://bitbucket.org/iBotPeaches/apktool/downloads/apktool_2.6.0.jar
HTTP/2 302 
content-security-policy-report-only: script-src 'unsafe-eval' 'strict-dynamic' 'unsafe-inline' 'self' http: https: https://d301sr5gafysq2.cloudfront.net; style-src 'self' 'unsafe-inline' https://aui-cdn.atlassian.com https://d301sr5gafysq2.cloudfront.net; report-uri https://web-security-reports.services.atlassian.com/csp-report/bb-website; default-src 'self' 'unsafe-inline' 'unsafe-eval' data: blob: *; connect-src bitbucket.org *.bitbucket.org bb-inf.net *.bb-inf.net id.atlassian.com analytics.atlassian.com as.atlassian.com api-private.stg.atlassian.com api-private.atlassian.com cofs.staging.public.atl-paas.net cofs.prod.public.atl-paas.net intake.opbeat.com api.media.atlassian.com api.segment.io xid.statuspage.io xid.atlassian.com xid.sourcetreeapp.com bam.nr-data.net bam-cell.nr-data.net sentry.io bqlf8qjztdtr.statuspage.io https://d301sr5gafysq2.cloudfront.net; object-src about:; base-uri 'self'
server: nginx
x-usage-quota-remaining: 994360.945
vary: Accept-Language, Origin
x-usage-request-cost: 816.13
cache-control: no-cache, no-store, must-revalidate, max-age=0
content-type: text/html; charset=utf-8
x-b3-traceid: 71799ae1785c3e51
x-usage-output-ops: 0
x-dc-location: Micros
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Tue, 14 Dec 2021 11:23:53 GMT
x-usage-user-time: 0.022208
x-usage-system-time: 0.002276
location: https://bbuseruploads.s3.amazonaws.com/0becf6a1-1706-4f2e-9ae6-891e00a8dd5f/downloads/26a2b46d-0908-468c-8666-c0c1a51db38c/apktool_2.6.0.jar?Signature=NYtYOScC1%2FeaAAXHoFujdhy0Cr0%3D&Expires=1639482043&AWSAccessKeyId=AKIA6KOSE3BNJRRFUUX6&versionId=RnPdd7QEjmy7sZV22zzk3kB5.yS9ffd1&response-content-disposition=attachment%3B%20filename%3D%22apktool_2.6.0.jar%22
x-served-by: aa45f345e0f0
expires: Tue, 14 Dec 2021 11:23:53 GMT
content-language: en
x-view-name: bitbucket.apps.downloads.views.download_file
x-static-version: ec1bee0bc410
x-render-time: 0.0436789989471
x-usage-input-ops: 0
x-request-count: 1636
x-frame-options: SAMEORIGIN
x-version: ec1bee0bc410
x-cache-info: not cacheable; response specified "Cache-Control: no-cache"
content-length: 0

I'm not. Can you provide link or exact curl output?

aburaksahin commented 2 years ago

Thank you for your swift response, here's what I get:

~ > curl -I https://bitbucket.org/iBotPeaches/apktool/downloads/apktool_2.6.0.jar
HTTP/2 302
content-security-policy-report-only: script-src 'unsafe-eval' 'strict-dynamic' 'unsafe-inline' 'self' http: https: https://d301sr5gafysq2.cloudfront.net; style-src 'self' 'unsafe-inline' https://aui-cdn.atlassian.com https://d301sr5gafysq2.cloudfront.net; report-uri https://web-security-reports.services.atlassian.com/csp-report/bb-website; default-src 'self' 'unsafe-inline' 'unsafe-eval' data: blob: *; connect-src bitbucket.org *.bitbucket.org bb-inf.net *.bb-inf.net id.atlassian.com analytics.atlassian.com as.atlassian.com api-private.stg.atlassian.com api-private.atlassian.com cofs.staging.public.atl-paas.net cofs.prod.public.atl-paas.net intake.opbeat.com api.media.atlassian.com api.segment.io xid.statuspage.io xid.atlassian.com xid.sourcetreeapp.com bam.nr-data.net bam-cell.nr-data.net sentry.io bqlf8qjztdtr.statuspage.io https://d301sr5gafysq2.cloudfront.net; object-src about:; base-uri 'self'
server: nginx
x-usage-quota-remaining: 998974.293
vary: Accept-Language, Origin
x-usage-request-cost: 1042.60
cache-control: no-cache, no-store, must-revalidate, max-age=0
content-type: text/html; charset=utf-8
x-b3-traceid: 3305b89fe3f61bd6
x-usage-output-ops: 0
x-dc-location: Micros
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Tue, 14 Dec 2021 11:27:30 GMT
x-usage-user-time: 0.022290
x-usage-system-time: 0.008988
location: https://bbuseruploads.s3.amazonaws.com/0becf6a1-1706-4f2e-9ae6-891e00a8dd5f/downloads/26a2b46d-0908-468c-8666-c0c1a51db38c/apktool_2.6.0.jar?Signature=mo0eR%2Bqo%2FZ8J3CtUdA1AATqKmqE%3D&Expires=1639482957&AWSAccessKeyId=AKIA6KOSE3BNJRRFUUX6&versionId=RnPdd7QEjmy7sZV22zzk3kB5.yS9ffd1&response-content-disposition=attachment%3B%20filename%3D%22apktool_2.6.0.jar%22
x-served-by: 9d9538cffe07
expires: Tue, 14 Dec 2021 11:27:30 GMT
content-language: en
x-view-name: bitbucket.apps.downloads.views.download_file
x-static-version: ec1bee0bc410
x-render-time: 0.0580570697784
x-usage-input-ops: 0
x-request-count: 4427
x-frame-options: SAMEORIGIN
x-version: ec1bee0bc410
x-cache-info: not cacheable; response specified "Cache-Control: no-cache"

With wget

~ > wget https://bitbucket.org/iBotPeaches/apktool/downloads/apktool_2.6.0.jar
--2021-12-14 14:28:52--  https://bitbucket.org/iBotPeaches/apktool/downloads/apktool_2.6.0.jar
Resolving bitbucket.org (bitbucket.org)... 104.192.141.1, 2406:da00:ff00::22c0:3470, 2406:da00:ff00::6b17:d1f5, ...
Connecting to bitbucket.org (bitbucket.org)|104.192.141.1|:443... connected.
HTTP request sent, awaiting response... 302 Found
Location: https://bbuseruploads.s3.amazonaws.com/0becf6a1-1706-4f2e-9ae6-891e00a8dd5f/downloads/26a2b46d-0908-468c-8666-c0c1a51db38c/apktool_2.6.0.jar?Signature=mo0eR%2Bqo%2FZ8J3CtUdA1AATqKmqE%3D&Expires=1639482957&AWSAccessKeyId=AKIA6KOSE3BNJRRFUUX6&versionId=RnPdd7QEjmy7sZV22zzk3kB5.yS9ffd1&response-content-disposition=attachment%3B%20filename%3D%22apktool_2.6.0.jar%22 [following]
--2021-12-14 14:28:53--  https://bbuseruploads.s3.amazonaws.com/0becf6a1-1706-4f2e-9ae6-891e00a8dd5f/downloads/26a2b46d-0908-468c-8666-c0c1a51db38c/apktool_2.6.0.jar?Signature=mo0eR%2Bqo%2FZ8J3CtUdA1AATqKmqE%3D&Expires=1639482957&AWSAccessKeyId=AKIA6KOSE3BNJRRFUUX6&versionId=RnPdd7QEjmy7sZV22zzk3kB5.yS9ffd1&response-content-disposition=attachment%3B%20filename%3D%22apktool_2.6.0.jar%22
Resolving bbuseruploads.s3.amazonaws.com (bbuseruploads.s3.amazonaws.com)... 52.217.170.225
Connecting to bbuseruploads.s3.amazonaws.com (bbuseruploads.s3.amazonaws.com)|52.217.170.225|:443... connected.
ERROR: cannot verify bbuseruploads.s3.amazonaws.com's certificate, issued by ‘emailAddress=support@fortinet.com,CN=FGT60FTK20023657,OU=Certificate Authority,O=Fortinet,L=Sunnyvale,ST=California,C=US’:
  Unable to locally verify the issuer's authority.
To connect to bbuseruploads.s3.amazonaws.com insecurely, use `--no-check-certificate'.
iBotPeaches commented 2 years ago

I don't think AWS uses fortinet as their SSL provided. You appear to have a firewall/vpn/something affecting traffic. Sorry - not a bug

iBotPeaches commented 2 years ago

As another quick note, Fortinet intercepting SSL sucks, but I guess some companies have to do it. You can read here how they impersonate domains - https://docs.fortinet.com/document/fortigate/6.0.0/cookbook/605938/why-you-should-use-ssl-inspection

aburaksahin commented 2 years ago

I've tried it on different computers within and without various VPNs, did not do any good. I guess I'll try to find another way. Thank you