Temporary fix to workaround server bug #3877

ETags are being stripped from staging/production servers
due to an Apache misconfiguration.

For now we should not use the ETag until this is addressed
server-side.

sdclientapi/__init__.py

@@ -459,7 +459,6 @@ def download_submission(
 
             # Get the headers
             headers = headers
-            etag = headers["Etag"]
 
             if not self.proxy:
                 # This is where we will save our downloaded file
@@ -475,10 +474,11 @@ def download_submission(
                 filepath = os.path.join(
                     "/home/user/QubesIncoming/", proxyvmname, data["filename"]
                 )
-            # Because etag comes as JSON encoded string
-            etag = json.loads(etag)
             # Return the tuple of sha256sum, filepath
-            return etag[7:], filepath
+            # Returning empty string instead of sha256sum due to this
+            # SecureDrop server bug:
+            # https://github.com/freedomofpress/securedrop/issues/3877
+            return "", filepath
         except Exception as err:
             raise BaseError(err)
 
@@ -684,7 +684,6 @@ def download_reply(self, reply: Reply, path: str = "") -> Tuple[str, str]:
 
             # Get the headers
             headers = headers
-            etag = headers["Etag"]
 
             if not self.proxy:
                 # This is where we will save our downloaded file
@@ -700,10 +699,11 @@ def download_reply(self, reply: Reply, path: str = "") -> Tuple[str, str]:
                 filepath = os.path.join(
                     "/home/user/QubesIncoming/", proxyvmname, data["filename"]
                 )
-            # Because etag comes as JSON encoded string
-            etag = json.loads(etag)
             # Return the tuple of sha256sum, filepath
-            return etag[7:], filepath
+            # Returning empty string instead of sha256sum due to this
+            # SecureDrop server bug:
+            # https://github.com/freedomofpress/securedrop/issues/3877
+            return "", filepath
         except Exception as err:
             raise BaseError(err)
 

tests/test_api.py

@@ -194,15 +194,12 @@ def test_download_submission(self):
 
         # We need a temporary directory to download
         tmpdir = tempfile.mkdtemp()
-        etag, filepath = self.api.download_submission(s, tmpdir)
+        _, filepath = self.api.download_submission(s, tmpdir)
 
         # now let us read the downloaded file
         with open(filepath, "rb") as fobj:
             data = fobj.read()
 
-        shasum = hashlib.sha256(data).hexdigest()
-        self.assertEqual(etag, shasum)
-
         # Now the submission should have is_read as True.
 
         s = self.api.get_submission(s)
@@ -241,15 +238,12 @@ def test_download_reply(self):
 
         # We need a temporary directory to download
         tmpdir = tempfile.mkdtemp()
-        etag, filepath = self.api.download_reply(r, tmpdir)
+        _, filepath = self.api.download_reply(r, tmpdir)
 
         # now let us read the downloaded file
         with open(filepath, "rb") as fobj:
             data = fobj.read()
 
-        shasum = hashlib.sha256(data).hexdigest()
-        self.assertEqual(etag, shasum)
-
         # Let us remove the temporary directory
         shutil.rmtree(tmpdir)
 

tests/test_apiproxy.py

@@ -224,15 +224,15 @@ def test_delete_reply(self):
     def test_download_reply(self):
         r = self.api.get_all_replies()[0]
 
-        etag, filepath = self.api.download_reply(r)
+        _, filepath = self.api.download_reply(r)
 
     @dastollervey_datasaver
     def test_download_submission(self):
         s = self.api.get_all_submissions()[0]
 
         self.assertFalse(s.is_read)
 
-        etag, filepath = self.api.download_submission(s)
+        _, filepath = self.api.download_submission(s)
 
         # Now the submission should have is_read as True.
         s = self.api.get_submission(s)