Release ForgeFlow 0.8.5 trusted asset downloads

src/main/update-service.cjs

@@ -291,7 +291,7 @@ class UpdateService {
     const assets = Array.isArray(release.assets) ? release.assets : [];
     const asset = assets.find((item) => item.name === assetName);
     const checksumAsset = assets.find((item) => item.name === checksumName);
-    if (!asset?.browser_download_url || !checksumAsset?.browser_download_url) {
+    if (!asset?.id || !checksumAsset?.id) {
       const error = new Error(
         `Release v${update.remoteVersion} is missing ${assetName} or its SHA-256 file.`,
       );
@@ -300,8 +300,12 @@ class UpdateService {
     }
 
     const [binary, checksumBytes] = await Promise.all([
-      this.gitea.downloadAuthenticated(asset.browser_download_url),
-      this.gitea.downloadAuthenticated(checksumAsset.browser_download_url),
+      this.gitea.downloadReleaseAsset(update.owner, update.repo, asset.id),
+      this.gitea.downloadReleaseAsset(
+        update.owner,
+        update.repo,
+        checksumAsset.id,
+      ),
     ]);
     if (binary.length < 1_000_000 || binary[0] !== 0x4d || binary[1] !== 0x5a) {
       throw new Error(
@@ -639,7 +643,10 @@ class UpdateService {
       .catch(() => []);
     const candidates = [];
     for (const entry of entries) {
-      if (!entry.isFile() || !/^(?:apply|binary)-.*\.status\.json$/i.test(entry.name))
+      if (
+        !entry.isFile() ||
+        !/^(?:apply|binary)-.*\.status\.json$/i.test(entry.name)
+      )
         continue;
       const filePath = path.join(this.updateDirectory, entry.name);
       const stat = await fs.stat(filePath).catch(() => null);