Zenodo release failed

[wheeheee]

The releases of 0.7.10 and 0.8 aren't reflected in zenodo. Apparently the request failed with "errors": "401 Bad credentials", so the webhook was probably triggered except a secret / access token was missing, but then I don't see anything under Webhooks / Recent Deliveries.
So that's weird.

[martinholters]

I've disabled and re-enabled DSP.jl in Zenodo, which has re-created the webhook. Now there is a successful "ping" under "Recent Deliveries". So hopefully, this will work in the future. Not sure how/if we can trigger this for this existing, missed releases.

[wheeheee]

Perhaps you could try adapting the code from this link?
https://gist.github.com/mkitti/b8f6f0568122eabb234d9ce6011210e2

[martinholters]

Just done that and it has successfully added a bunch of old versions, but for 0.7.9 and 0.8.0, I got:

┌ Warning: An HTTP Status Error has occured
│   error_response =
│    JSON3.Object{Base.CodeUnits{UInt8, String}, Vector{UInt64}} with 2 entries:
│      :message => "The release has already been received."
│      :status  => 409

I'm confused.

[wheeheee]

And when sorted by version 0.6.2 is at the top, followed by 0.5.2...very weird

[martinholters]

Apparently it's sorted by the date it was added to Zenodo, not the publication date, and the bunch of additions that happened in a short time interval are just sorted randomly. Sorting by publication date gives a reasonable list. But I haven't found an option to make that sorting order the default.

BTW, the link in the README seems to be specific to v0.7.9. Once we have Zenodo giving the proper version as the latest, we should update it to https://doi.org/10.5281/zenodo.7016211, which "represents all versions, and will always resolve to the latest one."

[martinholters]

Hm... https://zenodo.org/account/settings/github/repository/JuliaDSP/DSP.jl lists v0.7.10 and v0.8.0 as failed releases (due to "401 Bad credentials") - probably that's why they cannot be created (again) now. Does that mean anyone can block any future releases from appearing on Zenodo by sending a respective request with a random (invalid) token? That would be... quite bad.

[martinholters]

So based on https://gist.github.com/mkitti/b8f6f0568122eabb234d9ce6011210e2, I've sent "deleted" events to Zenodo for the two missing releases, which received a 202 "Accepted" but apparently were just ignored by Zenodo. I've also changed v0.7.10 to pre-release and back which made Github call the Zenodo webhook, but that also resulted in a 409 "The release has already been received." Maybe manually adding those releases to Zenodo could work, but I'm not too motivated right now...

[wheeheee]

Hm... https://zenodo.org/account/settings/github/repository/JuliaDSP/DSP.jl lists v0.7.10 and v0.8.0 as failed releases (due to "401 Bad credentials") - probably that's why they cannot be created (again) now. Does that mean anyone can block any future releases from appearing on Zenodo by sending a respective request with a random (invalid) token? That would be... quite bad.

Sounds serious, yeah. Let's just file a bug report on the Zenodo repo and call it a day?

[martinholters]

I've contacted Zenodo support about this and they've added the two missing releases and also offered to fix the ordering. I've happy accepted that, should hopefully happen in the foreseeable future.

[wheeheee]

Okay, new error (tokens expired? anyway, I don't have permissions to flip the switch on and off)

{
    "error_id": "04ba2876218b4ce38e7d1dc7b4594abf",
    "errors": "401 Bad credentials"
}