cb99f0b11bdeee5dfa76064d38b6410da0f4a709
max
  Thu Sep 10 00:55:21 2026 -0700
Centralize CGI Content-Type printing in one cgiPrintContentType() helper

Around 90 places across the tree hand-rolled the CGI response header, each
with its own spelling: "Content-Type:" or "Content-type:", \n or \r\n, and
the terminating blank line written as part of the same string, as a separate
puts("\n") (which emits two newlines, so a stray blank line led the body) or
as printf("\r\n\r\n") (two blank lines).  A handful forgot the terminator
entirely and relied on a following header to supply it.

cgiPrintContentType() in lib/cheapcgi.c now writes the Content-Type line and
the blank line that ends the header.  Header lines are not ordered, so the
callers that also send Status, Set-Cookie, Content-Disposition, Content-Length
or X-Sendfile write those first and call this last to close the header; that
keeps it to a single helper rather than a print-the-line / end-the-header pair
that a caller can half-use.  cart.c's existing httpHeaders list already worked
this way.

Only the CGI response path is touched.  The dyStringPrintf("Content-type: ...")
calls that build outgoing HTTP *requests* (genomeSpace, oauthLogin, eapMetaSync,
edwWebAuthLogin, ga4ghToBed) are unrelated and left alone.

Also fills out the apiKey error message in botDelay.c to say where to create a
key and that keys are server-specific.

No behavior change on the wire beyond dropping those stray blank lines and
adding the missing newline after Retry-After.

diff --git src/lib/textOut.c src/lib/textOut.c
index f8c6a1d1139..afa4258359b 100644
--- src/lib/textOut.c
+++ src/lib/textOut.c
@@ -118,52 +118,54 @@
     {
     FILE *f;
     f = fopen(fileName, "w");
     /* We want to capture stdout output to a file */
     fflush(stdout);
     int tempOut = dup(STDOUT_FILENO);
     if (saveStdout)
 	*saveStdout = tempOut;
     dup2(fileno(f),STDOUT_FILENO);   /* closes STDOUT before setting it again */
     fclose(f);
     }
 
 trimSpaces(fileName);
 if (isEmpty(fileName))
     {
-    printf("Content-Type: text/plain\n\n");
+    cgiPrintContentType("text/plain");
     }
 else if (isEmpty(compressType) || sameWord(compressType, textOutCompressNone))
     {
     if (!outToFile)
 	{
-	printf("Content-Type: application/octet-stream\n");
-	printf("Content-Disposition: attachment; filename=%s\n\n", fileName);
+	printf("Content-Disposition: attachment; filename=%s\n", fileName);
+	cgiPrintContentType("application/octet-stream");
 	}
     }
 else
     {
 
     if (!outToFile)
 	{
 	char *suffix = getCompressSuffix(compressType);
-	printf("Content-Type: application/x-%s\n", compressType);
 	if (endsWith(fileName, suffix))
-	    printf("Content-Disposition: attachment; filename=%s\n\n", fileName);
+	    printf("Content-Disposition: attachment; filename=%s\n", fileName);
 	else
-	    printf("Content-Disposition: attachment; filename=%s%s\n\n",
+	    printf("Content-Disposition: attachment; filename=%s%s\n",
 		   fileName, suffix);
+	char contentType[256];
+	safef(contentType, sizeof(contentType), "application/x-%s", compressType);
+	cgiPrintContentType(contentType);
 	/* Send the Content header uncompressed! */
 	fflush(stdout);
 	}
 
     /* Make sure no environment variables interfere with compressor. */
     cleanEnvVars(compressType);
 
     /* Redirect stdout to compressor pipeline object. */
     compressPipeline = pipelineOpen1(getCompressor(compressType),
 				     pipelineWrite, NULL, NULL, 0);
     if (-1 == dup2(pipelineFd(compressPipeline), STDOUT_FILENO))
 	errnoAbort("dup2(pipelineFd %d, stdout %d) failed in textOpen()",
 		   pipelineFd(compressPipeline), STDOUT_FILENO);
     }
 pushWarnHandler(textOutWarnHandler);