From fcd873367978bfaf718e43d33f3a055dcd571ac0 Mon Sep 17 00:00:00 2001
From: wangjia <809946525@qq.com>
Date: Sat, 18 Jul 2026 07:30:38 +0800
Subject: [PATCH] =?UTF-8?q?fix(ci):=20fetch=20=E7=94=A8=20browser=5Fdownlo?=
 =?UTF-8?q?ad=5Furl=20=E4=B8=8B=E8=BD=BD(assets=20API=20=E8=BF=94=E5=9B=9E?=
 =?UTF-8?q?=E5=85=83=E6=95=B0=E6=8D=AE=E9=9D=9E=E4=BA=8C=E8=BF=9B=E5=88=B6?=
 =?UTF-8?q?)+=20=E5=A4=A7=E5=B0=8F=E6=A0=A1=E9=AA=8C?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

测试发现 Gitea /releases/{id}/assets/{id} 端点返回附件元数据 JSON(260B)而非二进制。
改用 browser_download_url 直链下载,并加 <1MB 拒绝发版的完整性校验。
端到端验证:winstage-v9.9.9 → 拉到完整 25M PE32 安装器;版本不匹配硬失败。

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01P9G7E3wmAYL9KeYCVZVsqu
---
 scripts/ci/fetch-windows-staged.sh | 19 ++++++++++++-------
 1 file changed, 12 insertions(+), 7 deletions(-)

diff --git a/scripts/ci/fetch-windows-staged.sh b/scripts/ci/fetch-windows-staged.sh
index 7de155e..5344258 100755
--- a/scripts/ci/fetch-windows-staged.sh
+++ b/scripts/ci/fetch-windows-staged.sh
@@ -32,17 +32,22 @@ MSG
   exit 1
 fi
 
-# 找到同名资产 id 并下载（版本已由 STAGE_TAG 精确锁定）。JSON 经 stdin 传入避免转义问题。
-aid=$(printf '%s' "$info" | python3 -c "import sys,json; print(next((a['id'] for a in json.load(sys.stdin).get('assets',[]) if a['name']=='${NAME}'), ''))")
-rid=$(printf '%s' "$info" | python3 -c "import sys,json; print(json.load(sys.stdin)['id'])")
+# 取同名资产的 browser_download_url（版本已由 STAGE_TAG 精确锁定）。JSON 经 stdin 传入避免转义。
+# 注意：API 的 /assets/{id} 端点返回的是**元数据 JSON**（非二进制），必须用 browser_download_url。
+dl=$(printf '%s' "$info" | python3 -c "import sys,json; print(next((a['browser_download_url'] for a in json.load(sys.stdin).get('assets',[]) if a['name']=='${NAME}'), ''))")
 
-if [ -z "$aid" ]; then
+if [ -z "$dl" ]; then
   echo "ERROR: ${STAGE_TAG} 存在但缺少 ${NAME} 资产（GitHub 构建可能失败）。" >&2
   exit 1
 fi
 
-echo "==> fetch-windows-staged: 下载 asset id=${aid} → dist/${NAME}"
-curl -kfsS -H "Authorization: token ${FORGEJO_TOKEN}" \
-  "${base}/releases/${rid}/assets/${aid}" -o "dist/${NAME}"
+echo "==> fetch-windows-staged: 下载 ${dl} → dist/${NAME}"
+curl -kfsSL -H "Authorization: token ${FORGEJO_TOKEN}" "$dl" -o "dist/${NAME}"
 ls -lh "dist/${NAME}"
+# 完整性校验：安装器至少应有 1MB，防重定向页/截断被当成有效包发出去。
+sz=$(wc -c < "dist/${NAME}")
+if [ "$sz" -lt 1000000 ]; then
+  echo "ERROR: 下载的 ${NAME} 仅 ${sz} 字节，疑似重定向页/损坏，拒绝发版。" >&2
+  exit 1
+fi
 echo "==> fetch-windows-staged: done（版本 ${VER} 匹配）"