Save last downloaded URL & display it in post download page

[DivergentEuropeans]

Simple use of localStorage to store last downloaded URL and then add it to post download page. This doesnt break Legal because it is after the Agree/Disagree step

This adds support to V3, V2, V1, CLI, Client SDKs etc. and every major downloadable thing I see in the Downloads section

[balhar-jakub]

I think we can delete the post_download_legacy instead of updating it.

As for the legal, it does create some issues, as later on the URL without the agreement can be shared and then the person using the URL didn't consent to the agreement while being able to download the link. We may need to update the legal text appropriately, if we want to provide the URL.

I believe, though, that the usefulness of the URL is more important than this specific detail. But I would like to hear @jmertic and @MarkAckert

This doesn't change the fact that we need to decouple the download under separate entity instead of being hosted from zowe.org

[MarkAckert]

post_download_legacy should be kept for now, it's used for downloading artifacts which have a GPG signature instead of a sigstore bundle available. This is Zowe < 2.18.1 and <3.0.0, and some non-core projects that appear on the downloads page.
If we change post_download to handle both cases, then we can delete post_download_legacy

I don't have additional input on legality other than noting this would offer a change on how we direct users, which Jakub noted. If they follow click here to try a download again, it brings them back to the legal agreement right now.

To the click here point..is there a reason that click here button is insufficient as-is? What problem are we solving adding a JFrog link display to the download text? And as text, not a hyperlink?

[jmertic]

I think the biggest legal issue is that the binaries must be hosted on a tool owned by the Zowe Binary Project Series LLC. No matter what happens - that needs done.

Aside from that, we should make best effort to drive people through the EULA. I wouldn't over-index if people are clever enough to decipher URLs

[balhar-jakub]

@jmertic Can you create a fork of this repository in the organization you talk about? That way the only remaining thing needed is to set up the GH page.

Then updating the links here, which is something I can simply do.

[jmertic]

@balhar-jakub Hey - do you want me to fork the entire website, or just the pages that need to be in a separate domain?

[DivergentEuropeans]

I'd like to make a few points to follow up from TSC @balhar-jakub @jmertic @MarkAckert

as later on the URL without the agreement can be shared and then the person using the URL didn't consent to the agreement while being able to download the link

Yes, but to be clear, this is something that can be done now anyway 🙂 The pandora's box is open, to download a URL, you have to see it. This PR makes the URL easier to see for regular people without compromising security concerning a bad actor

we should make best effort to drive people through the EULA

To me, it sounds like without running the risk of over-engineering, over-legalizing this PR, the TODO is to just add to the text in Thank you Download page (that includes the URL):

"By downloading, you accept the End User License Agreement for Zowe. If you had an issue or your download [...]"

Is that fair?

[DivergentEuropeans]

Oh, missed @MarkAckert ask

To the click here point..is there a reason that click here button is insufficient as-is? What problem are we solving adding a JFrog link display to the download text? And as text, not a hyperlink?

download URL =/= click here button URL. I wouldn't mind making them the same, as it accomplishes exactly what I did in this PR

[jmertic]

@DivergentEuropeans In my view, the two key things are...

• Have the binary assets be delivered from a location owned by Zowe Binary Project LLC
• Have the user presented with the EULA and gain their consent before downloading.

You are right that anyone can work around the EULA if they are clever at finding the source links; at this stage, I'm less worried about people being clever versus the clear issue we have on the first two items. The project can go back and rethink the people going around the EULA issue down the road, if it's considered a major issue.

Let me know if that makes sense.

[DivergentEuropeans]

Sure, that makes sense to me @jmertic I guess I'm not sure what the next steps are for this PR. Those seem unrelated to this. Apologies if not understanding something