Release ForgeFlow 0.8.5 trusted asset downloads

src/main/gitea-service.cjs

@@ -331,6 +331,14 @@ class GiteaService {
     throw new Error("The update download exceeded the redirect limit.");
   }
 
+  async downloadReleaseAsset(owner, repo, assetId, options = {}) {
+    const numericId = Number(assetId);
+    if (!Number.isSafeInteger(numericId) || numericId <= 0)
+      throw new Error("Gitea returned an invalid release asset ID.");
+    const assetPath = `/api/v1/repos/${encodeURIComponent(owner)}/${encodeURIComponent(repo)}/releases/assets/${numericId}`;
+    return this.downloadAuthenticated(assetPath, options);
+  }
+
   async dispatchWorkflow({ owner, repo, workflowFile, ref, inputs = {} }) {
     const result = await this.request(
       `/repos/${encodeURIComponent(owner)}/${encodeURIComponent(repo)}/actions/workflows/${encodeURIComponent(workflowFile)}/dispatches`,

src/main/update-service.cjs

@@ -291,7 +291,7 @@ class UpdateService {
     const assets = Array.isArray(release.assets) ? release.assets : [];
     const asset = assets.find((item) => item.name === assetName);
     const checksumAsset = assets.find((item) => item.name === checksumName);
-    if (!asset?.browser_download_url || !checksumAsset?.browser_download_url) {
+    if (!asset?.id || !checksumAsset?.id) {
       const error = new Error(
         `Release v${update.remoteVersion} is missing ${assetName} or its SHA-256 file.`,
       );
@@ -300,8 +300,12 @@ class UpdateService {
     }
 
     const [binary, checksumBytes] = await Promise.all([
-      this.gitea.downloadAuthenticated(asset.browser_download_url),
-      this.gitea.downloadAuthenticated(checksumAsset.browser_download_url),
+      this.gitea.downloadReleaseAsset(update.owner, update.repo, asset.id),
+      this.gitea.downloadReleaseAsset(
+        update.owner,
+        update.repo,
+        checksumAsset.id,
+      ),
     ]);
     if (binary.length < 1_000_000 || binary[0] !== 0x4d || binary[1] !== 0x5a) {
       throw new Error(
@@ -639,7 +643,10 @@ class UpdateService {
       .catch(() => []);
     const candidates = [];
     for (const entry of entries) {
-      if (!entry.isFile() || !/^(?:apply|binary)-.*\.status\.json$/i.test(entry.name))
+      if (
+        !entry.isFile() ||
+        !/^(?:apply|binary)-.*\.status\.json$/i.test(entry.name)
+      )
         continue;
       const filePath = path.join(this.updateDirectory, entry.name);
       const stat = await fs.stat(filePath).catch(() => null);

src/renderer/mock-bridge.js

@@ -564,7 +564,7 @@
       await wait(80);
       snapshot();
       return {
-        appVersion: "0.8.4-demo",
+        appVersion: "0.8.5-demo",
         platform: "win32",
         state: clone(state),
         git: { available: true, version: "git version 2.47.3" },