fix: fix windows iso downloading

[Crab-K1ng]

Description

Fix windows iso downloading by implement the ov-df.microsoft.com request/reply it requires

i based this of the Fido downlaoder.

i was able to get it to work but i wasn't able to do a full test as i got blocked by Microsoft so i understand if you can't pull this

Type of change

• [ x] Bug fix (non-breaking change which fixes an issue)

Checklist:

• [ x] I have performed a self-review of my code
• I have tested my code in common scenarios and confirmed there are no regressions
• I have added comments to my code, particularly in hard-to-understand sections

[cubic-dev-ai]

3 issues found across 1 file

Confidence score: 2/5

• In quickget, the query string uses {$instanceId}, which sends curly braces as literal characters and can corrupt the handshake URL parameters; merging as-is risks download/session negotiation failures for users — switch to ${instanceId} (or $instanceId) before merging.
• In quickget, the macOS path builds mdt with %N, but BSD date returns %N literally, producing a non-numeric timestamp that can break the Windows ov-df handshake on a supported platform — replace this with a portable milliseconds calculation before merge.
• In quickget, missing validation for parsed mdt.js fields (w/rticks) allows blocked or malformed responses to proceed as if successful, which can cause confusing downstream failures — add an explicit non-empty/validity check and fail fast when extraction fails.

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="quickget">

<violation number="1" location="quickget:3512">
P1: The URL query parameters use `{$instanceId}` instead of `${instanceId}` or `$instanceId`. In Bash, `{$instanceId}` inside double quotes expands the variable correctly but wraps the value in literal curly braces, producing `instanceId={560dc9f3-...}`. The same pattern is repeated in the second curl call with `{$session_id}`, `{$instanceId}`, `{$w}`, `{$current_time}`, and `{$rticks}` — all of which will have extraneous `{` and `}` wrapping the values. Several existing parameters in the same file (e.g. `session_id=$session_id` in the first URL and `sessionID=${session_id}` in subsequent API calls) demonstrate the correct syntax.</violation>

<violation number="2" location="quickget:3521">
P2: A malformed or blocked `mdt.js` response is not detected: empty `w`/`rticks` values are sent to ov-df and the function continues as if the handshake succeeded. Checking both extracted values before the reply would fail early and avoid issuing the subsequent API requests with invalid session state.</violation>

<violation number="3" location="quickget:3523">
P1: On macOS, the ov-df reply sends a non-numeric `mdt` timestamp because BSD `date` treats `%N` literally; this can make the Windows download handshake fail on a supported host platform. A portable seconds-to-milliseconds conversion (or an explicit `gdate` dependency) would avoid relying on GNU-only `%3N`.</violation>
</file>

<sub>Reply with feedback, questions, or to request a fix.

Re-trigger cubic</sub>

[cubic-dev-ai]

P1: On macOS, the ov-df reply sends a non-numeric mdt timestamp because BSD date treats %N literally; this can make the Windows download handshake fail on a supported host platform. A portable seconds-to-milliseconds conversion (or an explicit gdate dependency) would avoid relying on GNU-only %3N.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At quickget, line 3523:

<comment>On macOS, the ov-df reply sends a non-numeric `mdt` timestamp because BSD `date` treats `%N` literally; this can make the Windows download handshake fail on a supported host platform. A portable seconds-to-milliseconds conversion (or an explicit `gdate` dependency) would avoid relying on GNU-only `%3N`.</comment>

<file context>
@@ -3503,6 +3503,30 @@ function download_windows_workstation() {
+    local rticks="$(echo "$mdt_js_response" | grep -Eo 'rticks="?\+?[0-9]+' | head -1)"
+    rticks="${rticks##*[=\"+]}"
+
+    local current_time="$(date +%s%3N)"
+
+    curl --disable --silent --user-agent "$user_agent" --header "Accept:" --max-filesize 100K --fail --proto =https --tlsv1.2 --http1.1 -- "https://ov-df.microsoft.com/?session_id={$session_id}&CustomerId={$instanceId}&PageId=si&w={$w}&mdt={$current_time}&rticks={$rticks}" || {
</file context>

Suggested change

	local current_time="$(date +%s%3N)"
	local current_time="$(printf '%s000' "$(date +%s)")"

[cubic-dev-ai]

P1: The URL query parameters use {$instanceId} instead of ${instanceId} or $instanceId. In Bash, {$instanceId} inside double quotes expands the variable correctly but wraps the value in literal curly braces, producing instanceId={560dc9f3-...}. The same pattern is repeated in the second curl call with {$session_id}, {$instanceId}, {$w}, {$current_time}, and {$rticks} — all of which will have extraneous { and } wrapping the values. Several existing parameters in the same file (e.g. session_id=$session_id in the first URL and sessionID=${session_id} in subsequent API calls) demonstrate the correct syntax.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At quickget, line 3512:

<comment>The URL query parameters use `{$instanceId}` instead of `${instanceId}` or `$instanceId`. In Bash, `{$instanceId}` inside double quotes expands the variable correctly but wraps the value in literal curly braces, producing `instanceId={560dc9f3-...}`. The same pattern is repeated in the second curl call with `{$session_id}`, `{$instanceId}`, `{$w}`, `{$current_time}`, and `{$rticks}` — all of which will have extraneous `{` and `}` wrapping the values. Several existing parameters in the same file (e.g. `session_id=$session_id` in the first URL and `sessionID=${session_id}` in subsequent API calls) demonstrate the correct syntax.</comment>

<file context>
@@ -3503,6 +3503,30 @@ function download_windows_workstation() {
+    local instanceId="560dc9f3-1aa5-4a2f-b63c-9e18f8d0e175"
+    local mdt_js_response=""
+
+    mdt_js_response="$(curl --disable --silent --output /dev/null --user-agent "$user_agent" --header "Accept:" --max-filesize 100K --fail --proto =https --tlsv1.2 --http1.1 -- "https://ov-df.microsoft.com/mdt.js?instanceId={$instanceId}&PageId=si&session_id=$session_id")" || {
+        handle_curl_error $?
+        return $?
</file context>

[cubic-dev-ai]

P2: A malformed or blocked mdt.js response is not detected: empty w/rticks values are sent to ov-df and the function continues as if the handshake succeeded. Checking both extracted values before the reply would fail early and avoid issuing the subsequent API requests with invalid session state.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At quickget, line 3521:

<comment>A malformed or blocked `mdt.js` response is not detected: empty `w`/`rticks` values are sent to ov-df and the function continues as if the handshake succeeded. Checking both extracted values before the reply would fail early and avoid issuing the subsequent API requests with invalid session state.</comment>

<file context>
@@ -3503,6 +3503,30 @@ function download_windows_workstation() {
+    w="${w#*=}"
+
+    local rticks="$(echo "$mdt_js_response" | grep -Eo 'rticks="?\+?[0-9]+' | head -1)"
+    rticks="${rticks##*[=\"+]}"
+
+    local current_time="$(date +%s%3N)"
</file context>

Suggested change

	rticks="${rticks##*[=\"+]}"
	rticks="${rticks##*[=\"+]}"
	if [ -z "$w" ] || [ -z "$rticks" ]; then
	echo " - Microsoft servers returned invalid ov-df data."
	return 1
	fi

[cubic-dev-ai]

0 issues found across 1 file (changes from recent commits).

<sub>Requires human review: Auto-approval blocked by 3 unresolved issues from previous reviews.

Re-trigger cubic</sub>