fix: normalize Gitea release asset URLs

deploy/install.sh

@@ -126,17 +126,20 @@ download_release_url() {
 }
 
 release_asset_url() {
-  local asset_name=$1 asset_url api_origin
+  local asset_name=$1 api_origin repo_path release_tag encoded_tag encoded_asset
   if [ -n "$RELEASE_API_URL" ]; then
-    asset_url=$(jq -er --arg name "$asset_name" \
-      '.assets[] | select(.name == $name) | .browser_download_url
-       | strings | select(startswith("https://") or startswith("http://"))' \
-      "$WORK_DIR/release-api.json" | head -n 1) || die "Release asset $asset_name is missing"
+    jq -e --arg name "$asset_name" 'any(.assets[]?; .name == $name)' \
+      "$WORK_DIR/release-api.json" >/dev/null || die "Release asset $asset_name is missing"
+    release_tag=$(jq -er '.tag_name | strings
+      | select(test("^v[0-9A-Za-z][0-9A-Za-z._+-]{0,127}$"))' \
+      "$WORK_DIR/release-api.json") || die "Gitea Release tag is invalid"
     api_origin=$(printf '%s' "$RELEASE_API_URL" | sed -E 's#^(https?://[^/]+).*$#\1#')
-    case "$asset_url" in
-      "$api_origin"/*) printf '%s\n' "$asset_url" ;;
-      *) die "Release asset $asset_name must use the Gitea API host" ;;
-    esac
+    repo_path=$(printf '%s' "$RELEASE_API_URL" | sed -nE \
+      's#^https?://[^/]+/api/v1/repos/([A-Za-z0-9._-]+/[A-Za-z0-9._-]+)/releases/(latest|tags/[^/?#]+)$#\1#p')
+    [ -n "$repo_path" ] || die "KAIDI_RELEASE_API_URL must be a Gitea repository Release API endpoint"
+    encoded_tag=$(jq -rn --arg value "$release_tag" '$value | @uri')
+    encoded_asset=$(jq -rn --arg value "$asset_name" '$value | @uri')
+    printf '%s/%s/releases/download/%s/%s\n' "$api_origin" "$repo_path" "$encoded_tag" "$encoded_asset"
   else
     printf '%s/%s\n' "${RELEASE_BASE_URL%/}" "$asset_name"
   fi