Update store.py

store.py

@@ -43,9 +43,24 @@ def _hdr(extra=None):
     return h
 
 
+class _DropAuthOnRedirect(urllib.request.HTTPRedirectHandler):
+    """Large files are served from a CDN via a signed redirect; the Hub token must not
+    follow the request to another host (the CDN rejects it with 400)."""
+    def redirect_request(self, req, fp, code, msg, headers, newurl):
+        new = super().redirect_request(req, fp, code, msg, headers, newurl)
+        if new is not None:
+            from urllib.parse import urlsplit
+            if urlsplit(newurl).netloc != urlsplit(req.full_url).netloc:
+                new.remove_header("Authorization")
+        return new
+
+
+_OPENER = urllib.request.build_opener(_DropAuthOnRedirect)
+
+
 def _get_json(url, timeout=30):
     req = urllib.request.Request(url, headers=_hdr())
-    with urllib.request.urlopen(req, timeout=timeout) as r:
+    with _OPENER.open(req, timeout=timeout) as r:
         return json.loads(r.read().decode())