From 7bd2e2063c6e18ff7656fab7e2338eef7eac507b Mon Sep 17 00:00:00 2001
From: Felipe Zipitria <felipe.zipitria@owasp.org>
Date: Tue, 28 Jul 2026 08:57:49 -0300
Subject: [PATCH] ci: retry pcre2/zlib/openssl downloads in build-windows

The "Set up third-party libraries" step piped wget directly into tar
with no retry, so a single truncated download (gzip: stdin: unexpected
end of file / tar: Child returned status 1) killed the whole job with
no indication of which of the three downloads failed.

Download to a file first, with wget's own retry flags, then extract
once the download is complete. Piping straight into tar can't be
retried safely: a retried request restarts the response from byte 0,
but tar has already consumed whatever the first, truncated attempt
sent through the pipe -- a retry would just append a second copy of
the file after the first truncated one, corrupting the archive rather
than fixing anything. A file-based retry cleanly overwrites the
previous attempt instead.

Fixes #388

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
---
 .github/workflows/test_new.yml | 20 +++++++++++++++++---
 1 file changed, 17 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/test_new.yml b/.github/workflows/test_new.yml
index 7a98117..3e4822e 100644
--- a/.github/workflows/test_new.yml
+++ b/.github/workflows/test_new.yml
@@ -332,12 +332,26 @@ jobs:
       - name: Set up third-party libraries
         working-directory: nginx
         run: |
+          set -euo pipefail
           mkdir objs
           mkdir objs/lib
           cd objs/lib
-          wget -q -O - https://github.com/PCRE2Project/pcre2/releases/download/pcre2-10.47/pcre2-10.47.tar.gz | tar -xzf -
-          wget -q -O - https://www.zlib.net/fossils/zlib-1.3.2.tar.gz | tar -xzf -
-          wget -q -O - https://www.openssl.org/source/openssl-3.6.2.tar.gz | tar -xzf -
+          # Download to a file (with retries) before extracting, rather than
+          # piping straight into tar: a retried download restarts the
+          # response from byte 0, and a live pipe already mid-consumed by
+          # tar can't rewind -- it would just get a second copy of the file
+          # appended after the truncated first one, corrupting the archive.
+          # A file-based retry cleanly overwrites the previous attempt.
+          for url in \
+            https://github.com/PCRE2Project/pcre2/releases/download/pcre2-10.47/pcre2-10.47.tar.gz \
+            https://www.zlib.net/fossils/zlib-1.3.2.tar.gz \
+            https://www.openssl.org/source/openssl-3.6.2.tar.gz \
+          ; do
+            archive="$(basename "$url")"
+            wget --tries=3 --retry-connrefused --waitretry=5 -O "$archive" "$url"
+            tar -xzf "$archive"
+            rm "$archive"
+          done
       - name: Get libModSecurity source
         uses: actions/checkout@v6
         with: