Skip to content

[BUG] Demos can't be downloaded without Github authentication #3918

Description

@sgIOlas

Issue description

MASTG demo downloads return a 404 when trying to download artifacts without being authenticated in Github. This is a common issue that has been already discussed here for example. The intended behavior for us is that users are able to download demos without logged into Github.

How to reproduce

  1. Open a private web browser window.
  2. Navigate to any MASTG demo (e.g. https://mas.owasp.org/MASTG/demos/android/MASVS-RESILIENCE/MASTG-DEMO-0114/MASTG-DEMO-0114/).
  3. Try download de demo APK/IPA.
  4. Verify that Github returns a 404.
  5. Now repeat steps 2 and 3 while being authenticated in Github.

Possible solutions

Let's try to use this issue to brainstorm potential solutions to this problem. Here are some:

  • Update all artifact references in MASTG to an OWASP backed public storage box. The publishing action would mirror the artifact result to this storage.
  • Add a dummy release version with a non-standard version name such as "demos" and publish artifacts there from the action. Github seems to limit release size to 1000 artifacts (https://github.com/orgs/community/discussions/165616) so maybe this could be enough for our purpose.

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions