fix: preserve GitHub CDN redirects

tests/test_sideload.py

@@ -3,6 +3,7 @@
 from __future__ import annotations
 
 import hashlib
+from http.client import HTTPMessage
 import io
 import json
 import subprocess
@@ -693,7 +694,7 @@ class TestGenericSource:
         )
         with pytest.raises(ValueError, match="non-HTTPS"):
             sideload._HttpsOnlyRedirectHandler().redirect_request(
-                request, mock.Mock(), 302, "Found", "http://evil.example/", {}
+                request, mock.Mock(), 302, "Found", {}, "http://evil.example/"
             )
 
     def test_cross_host_redirect_is_blocked_and_same_origin_keeps_headers(self):
@@ -705,13 +706,55 @@ class TestGenericSource:
         )
         with pytest.raises(ValueError, match="changed origin"):
             handler.redirect_request(
-                request, mock.Mock(), 302, "Found", "https://cdn.example/file", {}
+                request, mock.Mock(), 302, "Found", {}, "https://cdn.example/file"
             )
         redirected = handler.redirect_request(
-            request, mock.Mock(), 302, "Found", "https://downloads.example/file", {}
+            request, mock.Mock(), 302, "Found", {}, "https://downloads.example/file"
         )
         assert redirected.get_header("Authorization") == "secret-token"
 
+    def test_github_cdn_redirect_drops_unredirected_host_and_keeps_authorization(self):
+        request = urllib.request.Request(
+            "https://github.com/example/app/releases/download/v1/app.apk",
+            headers={"Authorization": "secret-token"},
+        )
+        request.unredirected_hdrs["Host"] = "github.com"
+        handler = sideload._HttpsOnlyRedirectHandler(same_origin=False)
+
+        redirected = handler.redirect_request(
+            request,
+            mock.Mock(),
+            302,
+            "Found",
+            {},
+            "https://objects.githubusercontent.com/app.apk",
+        )
+
+        assert redirected.get_header("Host") is None
+        assert redirected.get_header("Authorization") == "secret-token"
+
+    def test_https_redirect_accepts_http_message_headers(self):
+        request = urllib.request.Request(
+            "https://downloads.example/start", headers={"Authorization": "secret-token"}
+        )
+        headers = HTTPMessage()
+        headers.add_header("Location", "https://downloads.example/file.apk")
+        handler = sideload._HttpsOnlyRedirectHandler(
+            "https://downloads.example/start", same_origin=True
+        )
+
+        redirected = handler.redirect_request(
+            request,
+            mock.Mock(),
+            302,
+            "Found",
+            headers,
+            "https://downloads.example/file.apk",
+        )
+
+        assert redirected.full_url == "https://downloads.example/file.apk"
+        assert redirected.get_header("Authorization") == "secret-token"
+
     def test_atomic_download_rejects_downgrade_before_response_body(self):
         request = urllib.request.Request("https://downloads.example/file.apk")
         handler = sideload._HttpsOnlyRedirectHandler(
@@ -720,7 +763,7 @@ class TestGenericSource:
         with pytest.raises(ValueError, match="non-HTTPS"):
             handler.redirect_request(
                 request, mock.Mock(read=mock.Mock(side_effect=AssertionError)),
-                302, "Found", "http://downloads.example/file.apk", {}
+                302, "Found", {}, "http://downloads.example/file.apk"
             )
 
     def test_redirected_page_url_is_used_for_relative_links(self):