Bug 2382271

Bug Report: DNF 5.2 Fails to Download Packages with Special Characters in Filename
Report Date: July 18, 2025 Component: DNF (Dandified YUM) Affected Version: 5.2.13.1 Previous Working Version: 4.21

1. Summary
An issue has been identified in DNF version 5.2 where it is unable to download RPM packages that contain a caret (^) symbol in the filename using Artifactory. This functionality was operational in DNF version 4.21. The root cause of this failure is a change in how DNF 5.2 handles special characters in URLs; specifically, it no longer applies URL-encoding to the caret symbol. This results in a malformed GET request that is rejected by the upstream webserver before it reaches the repository application (Artifactory).

2. Technical Analysis
To investigate the download failure, HTTP requests generated by both DNF 4.21 and DNF 5.2.13.1 were intercepted and inspected. The test package for this analysis was passt-0^20250611.g0293c6f-1.fc42.x86_64.rpm. The upstream used for testing was https://dl.fedoraproject.org/pub/.

The analysis revealed a difference in the URL formatting between the two versions.

DNF 4.21 (Successful Request) The older, functional version of DNF encodes the ^ character to its url-encoding equivalent, %5E. This results in a valid URL that the webserver processes correctly.
Intercepted Request:
GET /artifactory/rpm-remote-3/fedora/linux/updates/42/Everything/aarch64/Packages/p/passt-0%5E20250611.g0293c6f-1.fc42.aarch64.rpm

DNF 5.2.13.1 (Failed Request) The new version of DNF fails to encode the ^ character, sending it raw within the URL path.
Intercepted Request:
GET /artifactory/rpm-remote-3/fedora/linux/updates/42/Everything/x86_64/Packages/p/passt-0^20250611.g0293c6f-1.fc42.x86_64.rpm

3. Impact
Due to this change DNF installation packages like passt fails while using Artifactory.

Reproducible: Always

Steps to Reproduce:
1. Download a pacakge which has (^) symbol in the name.
2. Intercept the request sent to the upstream.
3. Notice the difference in the request path when using DNF 4.21 and DNF 5.2.13.1
Actual Results:
When using DNF 5.2.13.1, the request URL is not encoded, resulting in failure to download the package when using repository management tools like Artifactory.

Expected Results:
The requested URL path should be encoded when downloading a package using DNF 5.2.13.1.

Additional Information:
When using DNF 4.21, the URL is encoded when the name of the package has a (^) symbol.

Discussion on Fedora forum: https://discussion.fedoraproject.org/t/url-encoding-not-present-in-dnf-5-2-13-1/159292