CKAN dataset share links fail with 'invalid build token'

[u10313335]

Bug description

The CKAN dataset share url copied from the landing page of Binder will fail to open with 'invalid build token' error.

It looks like the trailing slash in the URL remains after commit 424f831. This might be the cause of the error.

However, removing the trailing slash leads to 'invalid build token' errors for other providers (e.g., Zenodo DOI) in my tests.

How to reproduce

1. Go to mybinder.org
2. Select the CKAN dataset provider
3. Input a URL for a CKAN dataset, e.g., https://demo.ckan.org/dataset/my-sample-dataset-001
4. Copy the share URL generated in the field below
5. Open the copied URL in the browser

Expected behaviour

The building process should start.

Actual behaviour

The 'invalid build token' error is shown:

Your personal set up

• OS: macOS 15.7.4
• Version(s): latest mybinder.org

Logs

I have used testing/local-binder-k8s-hub/binderhub_config.py to deploy and debug the error:

[E 260316 08:26:27 base:85] Failure to validate build token for ckan/https%3A%2F%2Fdemo.ckan.org%2Fdataset%2Fmy-sample-dataset-001: Audience doesn't match
[W 260316 08:26:27 web:1943] 403 GET /build/ckan/https%3A%2F%2Fdemo.ckan.org%2Fdataset%2Fmy-sample-dataset-001?build_token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJleHAiOjE3NzM2NDk4ODcsImF1ZCI6ImNrYW4vaHR0cHMlM0ElMkYlMkZkZW1vLmNrYW4ub3JnJTJGZGF0YXNldCUyRm15LXNhbXBsZS1kYXRhc2V0LTAwMS8iLCJvcmlnaW4iOiIxOTIuMTY4LjU2LjEzOjg1ODUifQ.ihqXXo-NQW6WoG1p4Etkbqlo0j3RrOvstxrkykQ17Ps (192.168.121.102): Invalid build token

[Kirubapanneers]

Hi, I would like to work on this issue!

[Kirubapanneers]

Hi, I’ve created a PR (#2077) to fix this issue. could you please review it and share your feedback? Thanks!

[u10313335]

Thank you @Kirubapanneers!

I have tried your PR (removing the trailing slash), but it leads to 'invalid build token' errors for the Zenodo DOI provider just I mentioned above. So I'm just wondering if there is any other way to address this bug.

[Kirubapanneers]

Hi @u10313335,
I’ve updated the PR with a fix.

The problem was that commit 424f831 changed the jwt aud value, causing a mismatch with CKAN. I’ve switched it back to use escaped_spec, which matches what builder.py expects.

could you please test it with CKAN and Zenodo DOI providers and let me know if it works? Thanks!

[u10313335]

Hi @Kirubapanneers,

Unfortunately, Zenodo's DOI provider is working, but CKAN is not now (same 'invalid build token' error).

[Kirubapanneers]

Hi, I've updated the fix. This time both main.py and builder.py strip the trailing slash consistently.

Unfortunately I don't have a Linux/docker/k8s environment to test locally. could you please test this updated fix with both CKAN and Zenodo DOI?

Thank you so much for your patience!