fix: keep release downloads on configured origin

distribution/bin/erp-update

@@ -220,12 +220,15 @@ if channel.lower() == "stable" and release.get("prerelease"):
     raise SystemExit("prerelease rejected on stable channel")
 if channel.lower() == "stable" and "-" in version.split("+", 1)[0]:
     raise SystemExit("prerelease tag rejected on stable channel")
-assets = {str(item.get("name")): str(item.get("browser_download_url") or "") for item in release.get("assets", [])}
+assets = {
+    str(item.get("name") or "")
+    for item in release.get("assets", [])
+    if isinstance(item, dict)
+}
 names = [f"kaidi-erp-{version}.tar.gz", "SHA256SUMS", "SHA256SUMS.sig"]
-urls = [assets.get(name, "") for name in names]
-if any(not value or any(ch.isspace() for ch in value) for value in urls):
+if any(name not in assets for name in names):
     raise SystemExit("release assets are incomplete")
-print("\t".join([version, *urls]))
+print("\t".join([version, tag]))
 PY
 }
 
@@ -371,7 +374,8 @@ install_release() {
     || fail "健康检查超时时间配置无效"
   [[ "$HEALTH_POLL_SECONDS" =~ ^[1-9][0-9]*$ ]] \
     || fail "健康检查间隔配置无效"
-  [[ "$REPOSITORY" =~ ^[^/[:space:]]+/[^/[:space:]]+$ ]] || fail "更新仓库配置无效"
+  [[ "$REPOSITORY" =~ ^[A-Za-z0-9][A-Za-z0-9._-]{0,99}/[A-Za-z0-9][A-Za-z0-9._-]{0,99}$ ]] \
+    || fail "更新仓库配置无效"
   require_command curl
   require_command python3
   require_command tar
@@ -386,9 +390,13 @@ install_release() {
 
   local selection="$TMP_DIR/selection"
   select_release "$release_json" "$requested" "$selection" || fail "Release 元数据验证失败" 10
-  local archive_url sums_url signature_url
-  IFS=$'\t' read -r TARGET_VERSION archive_url sums_url signature_url < "$selection"
+  local release_tag release_base archive_url sums_url signature_url
+  IFS=$'\t' read -r TARGET_VERSION release_tag < "$selection"
   local archive_name="kaidi-erp-${TARGET_VERSION}.tar.gz"
+  release_base="${GITEA_BASE_URL%/}/$owner/$repo/releases/download/$release_tag"
+  archive_url="$release_base/$archive_name"
+  sums_url="$release_base/SHA256SUMS"
+  signature_url="$release_base/SHA256SUMS.sig"
   local archive="$TMP_DIR/$archive_name" sums="$TMP_DIR/SHA256SUMS" signature="$TMP_DIR/SHA256SUMS.sig"
 
   write_state DOWNLOADING 20 "正在下载版本 ${TARGET_VERSION}" "$TARGET_VERSION"