fix: Don't set referer header when downloading sources

rust-tests/src/lib.rs

@@ -715,4 +715,17 @@ requirements:
         assert!(output.contains("No license files were copied"));
         assert!(output.contains("The following license files were not found: *.license"));
     }
+
+    #[test]
+    fn test_sourceforge_redirects() {
+        let tmp = tmp("test_sourceforge_redirects");
+        let rattler_build = rattler().build(
+            recipes().join("sourceforge-redirects"),
+            tmp.as_dir(),
+            None,
+            None,
+        );
+
+        assert!(rattler_build.status.success());
+    }
 }

src/tool_configuration.rs

@@ -104,6 +104,7 @@ impl BaseClient {
                 .no_gzip()
                 .pool_max_idle_per_host(20)
                 .user_agent(APP_USER_AGENT)
+                .referer(false)
                 .read_timeout(std::time::Duration::from_secs(timeout))
         };
 

test-data/recipes/sourceforge-redirects/recipe.yaml

@@ -0,0 +1,20 @@
+# yaml-language-server: $schema=https://raw.githubusercontent.com/prefix-dev/recipe-format/main/schema.json
+context:
+  version: "0.0.1"
+
+package:
+  name: sourceforge-redirect-test
+  version: ${{ version }}
+
+source:
+  # This URL requires 3 redirects across different hosts to reach the final file:
+  # 1. sourceforge.net -> sourceforge.net/download
+  # 2. sourceforge.net/download -> downloads.sourceforge.net?ts=...
+  # 3. downloads.sourceforge.net -> [mirror].dl.sourceforge.net
+  url: https://sourceforge.net/projects/arma/files/armadillo-15.2.1.tar.xz
+  sha256: a5b8109da3c169802f51a14d3bd1246395c24bbca55601760b0c96a3c0b2f8fa
+
+build:
+  number: 0
+  script:
+    - echo "Successfully downloaded from SourceForge with cross-host redirects"