[DRE-maint] Bug#1092987: vagrant: free Vagrant versions no longer work with HashiCorp Cloud Platform's Vagrant registry

[Lucas Nussbaum]

Package: vagrant
Version: 2.2.14+dfsg-2
Severity: serious

Hi,

It looks like a change in HCP (HashiCorp Cloud Platform, the replacement
for Vagrant Cloud to host Vagrant boxes images), introduced around
2025-01-09, broke versions of Vagrant below 2.4.0 (2.4.0 being the first
release of Vagrant under the 'Business Source License').

As a result, this makes it impossible to download images from HCP using
free versions of Vagrant (the versions packaged in Debian).

In detail (according to vagrant up --debug):
Up to Vagrant 2.3.7, vagrant fetches box metadata using:
/opt/vagrant/embedded/bin/curl -q -I --fail --location --max-redirs 10 --verbose --user-agent "Vagrant/2.3.7 (+https://www.vagrantup.com; ruby3.1.4)" --continue-at - -H "Accept: application/json" https://vagrantcloud.com/debian/bookworm64
and then:
opt/vagrant/embedded/bin/curl -q --fail --location --max-redirs 10 --verbose --user-agent "Vagrant/2.3.7 (+https://www.vagrantup.com; ruby3.1.4)" --continue-at - -H "Accept: application/json" https://vagrantcloud.com/debian/bookworm64
(without -I to fetch the actual data)

Since Vagrant 2.4.0, vagrant tries both:
/opt/vagrant/embedded/bin/curl -q -I --fail --location --max-redirs 10 --verbose --user-agent "Vagrant/2.4.0 (+https://www.vagrantup.com; ruby3.1.4)" --continue-at - -H "Accept: application/json" https://vagrantcloud.com/api/v2/vagrant/debian/bookworm64
and
/opt/vagrant/embedded/bin/curl -q -I --fail --location --max-redirs 10 --verbose --user-agent "Vagrant/2.4.0 (+https://www.vagrantup.com; ruby3.1.4)" --continue-at - -H "Accept: application/json" https://vagrantcloud.com/debian/bookworm64
then decides to use
/opt/vagrant/embedded/bin/curl -q --fail --location --max-redirs 10 --verbose --user-agent "Vagrant/2.4.0 (+https://www.vagrantup.com; ruby3.1.4)" --continue-at - -H "Accept: application/json" https://vagrantcloud.com/api/v2/vagrant/debian/bookworm64

As one can see,
curl --location --verbose -H "Accept: application/json" https://vagrantcloud.com/debian/bookworm64
no longer returns a JSON document, so Vagrant <2.4.0 fails to fetch box
metadata (and thus check for updates, get download link, etc.)

There are various reports of breakage on
https://github.com/hashicorp/vagrant/issues, most notably
https://github.com/hashicorp/vagrant/issues/13571 .

At this point, it's not clear if this change is intentional, so let's
not discuss consequences at this point. I opened a ticket on HashiCorp's ZenDesk
(https://support.hashicorp.com/hc/en-us/requests/171591)

Lucas