fix: keep release downloads on configured origin

install.sh

@@ -200,7 +200,8 @@ download() {
 }
 
 download_release() {
-  [[ "$REPOSITORY" =~ ^[^/[:space:]]+/[^/[:space:]]+$ ]] || fail 'invalid Gitea repository'
+  [[ "$REPOSITORY" =~ ^[A-Za-z0-9][A-Za-z0-9._-]{0,99}/[A-Za-z0-9][A-Za-z0-9._-]{0,99}$ ]] \
+    || fail 'invalid Gitea repository'
   local owner="${REPOSITORY%%/*}" repo="${REPOSITORY#*/}"
   local release_json="$TMP_DIR/release.json"
   download "${GITEA_BASE_URL%/}/api/v1/repos/$owner/$repo/releases/latest" "$release_json" \
@@ -223,17 +224,20 @@ if "-" in version.split("+", 1)[0]:
 requested = sys.argv[2].removeprefix("v")
 if requested and requested != version:
     raise SystemExit("requested version does not match latest release")
-assets = {str(a.get("name")): str(a.get("browser_download_url") or "") for a in release.get("assets", [])}
+assets = {
+    str(a.get("name") or "")
+    for a in release.get("assets", [])
+    if isinstance(a, dict)
+}
 names = [
     f"kaidi-erp-{version}.tar.gz",
     f"kaidi-erp-installer-{version}.jar",
     "SHA256SUMS",
     "SHA256SUMS.sig",
 ]
-urls = [assets.get(name, "") for name in names]
-if any(not url or any(ch.isspace() for ch in url) for url in urls):
+if any(name not in assets for name in names):
     raise SystemExit("release assets missing")
-print("\t".join([version, *urls]))
+print("\t".join([version, tag]))
 PY
   then
     local reason="invalid Release metadata"
@@ -241,10 +245,15 @@ PY
     fail "$reason"
   fi
 
-  local archive_url installer_url sums_url signature_url
-  IFS=$'\t' read -r VERSION archive_url installer_url sums_url signature_url < "$selection"
+  local release_tag release_base archive_url installer_url sums_url signature_url
+  IFS=$'\t' read -r VERSION release_tag < "$selection"
   ARCHIVE_NAME="kaidi-erp-${VERSION}.tar.gz"
   INSTALLER_NAME="kaidi-erp-installer-${VERSION}.jar"
+  release_base="${GITEA_BASE_URL%/}/$owner/$repo/releases/download/$release_tag"
+  archive_url="$release_base/$ARCHIVE_NAME"
+  installer_url="$release_base/$INSTALLER_NAME"
+  sums_url="$release_base/SHA256SUMS"
+  signature_url="$release_base/SHA256SUMS.sig"
   ARCHIVE_PATH="$TMP_DIR/$ARCHIVE_NAME"
   INSTALLER_PATH="$TMP_DIR/$INSTALLER_NAME"
   download "$archive_url" "$ARCHIVE_PATH"