What causes "Failed to extract filename from download URL" in gitbutlerapp/gitbutler?

Confirm validate_download_url(download_url) ran before this point; if not, that is the bug to fix.

Failed to extract filename from download URL

Error message

Failed to extract filename from download URL

What it means

Thrown in install_macos.rs when download_url.split('/').next_back() is None while deriving the tarball filename. In practice str::split always yields at least one element, so this arm is a defensive guard that is only reachable with a degenerate empty URL; for any real URL the last path segment becomes the filename.

Source

Thrown at crates/but-installer/src/install_macos.rs:48

    let download_url = platform_info.url.as_deref().ok_or_else(|| {
        anyhow::anyhow!(
            "No download URL for platform {} in release {}",
            config.platform,
            release.version
        )
    })?;

    validate_download_url(download_url)?;
    info(&format!("Download URL: {download_url}"));

    let temp_dir = tempfile::Builder::new()
        .prefix("gitbutler-install.")
        .tempdir()?;

    let filename = download_url
        .split('/')
        .next_back()
        .ok_or_else(|| anyhow::anyhow!("Failed to extract filename from download URL"))?;
    let tarball_path = temp_dir.path().join(filename);

    info(&format!("Downloading GitButler {}...", release.version));
    download_file(download_url, &tarball_path)?;

    validate_tarball(&tarball_path)?;
    success("Download completed successfully");

    verify_signature(&tarball_path, &platform_info.signature, temp_dir.path())?;

    info("Extracting archive...");
    let app_dir = extract_tarball(&tarball_path, temp_dir.path())?;
    success("Archive extracted successfully");

    verify_app_structure(&app_dir)?;

    install_app(&app_dir, &config.home_dir, channel)?;

View on GitHub (pinned to caf1f223d3)

Solutions

Confirm validate_download_url(download_url) ran before this point; if not, that is the bug to fix.
Log the actual download_url value to find which caller passed a degenerate string.
Update the but-installer crate — a refactor may have relaxed the earlier validation.

Defensive patterns

Strategy: validation

Validate before calling

// Ensure the URL is non-degenerate before extracting a filename
fn url_has_filename(url: &str) -> bool {
    url::Url::parse(url)
        .ok()
        .and_then(|u| u.path_segments().and_then(Iterator::last))
        .map(|s| !s.is_empty())
        .unwrap_or(false)
}

Prevention

Always run validate_download_url before processing release URLs.
In custom callers, never pass empty or scheme-only strings where a file URL is expected.

When it happens

Trigger: An empty or whitespace download_url reaching this code (which in practice cannot happen because validate_download_url runs first and requires https:// with a host); purely defensive code triggered by future refactors that bypass validation.

Common situations: Essentially unreachable in shipped code — if you see it, a code path skipped validate_download_url or passed a non-URL string; treat it as a bug report against the caller, not an environment problem.

Related errors

AI-assisted analysis of gitbutlerapp/gitbutler@caf1f223d3 (2026-08-20). Data as JSON: /api/errors/5705682990013f27. Report an issue: GitHub.