Screenshot mirror returns an empty body for a quarter of all apps

[nursoda]

apps.json hands clients raw screenshot URLs; a Nextcloud instance never fetches those
itself but asks the mirror at
https://usercontent.apps.nextcloud.com/<base64 of the URL as it appears in apps.json>.
For a large share of apps that mirror answers HTTP 200 with an empty body, while the
source URL serves the image fine. Instances therefore show no screenshot in the app list.
The store website is unaffected — it embeds the source URL directly.

Steps to reproduce

curl -sL --compressed -o apps.json https://apps.nextcloud.com/api/v1/platform/34.0.0/apps.json
jq -r '.[] | .id as $i | .screenshots[]? | $i + "\t" + (.url|@base64)' apps.json |
while IFS=$'\t' read -r id b64; do
  n=$(curl -s "https://usercontent.apps.nextcloud.com/$b64" | head -c 20 | wc -c)
  [ "$n" -eq 0 ] && echo "empty: $id"
done

The base64 key must be built from the URL string exactly as it appears in apps.json,
including any surrounding whitespace — several apps write <screenshot> across multiple
lines in info.xml, and that whitespace is part of the key. (Whitespace itself is not the
bug: 80 of the 88 whitespace-carrying URLs are mirrored correctly.)

Expected behaviour

The mirror serves the image, as it does for the majority of apps.

Actual behaviour

Measured 2026-09-09 against /api/v1/platform/34.0.0/apps.json:

result	screenshot URLs
image delivered	763
empty body (0 bytes)	318
body File not found (14 bytes)	5
total	1086 (from 381 apps)

97 of 381 apps with screenshots have at least one empty image.
Examples: moviedb, crate, n8n_sync, homecheck, maintenancecheck, twofactor_email,
folder_protection, kanso, integration_pexip, agora, llmchat, launchpad.

A random sample of ten affected URLs was fetched from their source: all ten returned
HTTP 200 with the full image (94–630 KB). So the source is not the problem.

Guess

A first fetch that failed appears to be cached as an empty entry and never retried.
Re-fetching on an empty cache entry, or not caching failures at all, would fix it.

[edward-ly]

Thanks for letting us know! First of all, this does indeed concern the usercontent.apps.nextcloud.com project rather than the app store itself, so I'm moving this issue over there. Second, I'm not sure if there's actually an issue with the current code, but some images may have slipped through the cracks due to recent changes to the project. Either way, it might be useful to add a check on the existing images and delete those with an empty or File not found body. If you're interested in working on this, we happily accept and review PRs.

[nursoda]

Thanks for looking into it. Sorry for the wrong repo. I don't have time to work on it, found it while debugging my own app twofactor_email, and I'm quite busy with it. Not sure whether I should close here.