fix: enforce manifest-based component downloads and validate package URLs during release builds

release.js

@@ -247,6 +247,9 @@ async function main() {
     for (const [name, c] of Object.entries(manifestData.components || {})) {
         console.log(`Uploading ${c.file}...`);
         c.url = await uploadFileToGitLabPackage(path.join(__dirname, 'release-assets', c.file), 'vyla-home', version, `${name}-${timestamp}.zip`);
+        if (!c.url || !c.url.includes('/packages/generic/vyla-home/')) {
+            throw new Error(`Upload for ${name} did not return a package URL.`);
+        }
     }
 
     const signingKeyPem = process.env.VYLA_UPDATE_SIGNING_KEY;

update-client.js

@@ -379,13 +379,13 @@ class UpdateClient {
 
     const components = {};
     for (const [name, c] of Object.entries(manifest.components)) {
-      const link = links.find((a) => a.name === c.file);
       const direct = typeof c.url === 'string' &&
-        c.url.startsWith('https://gitlab.com/api/v4/projects/') &&
+        c.url.startsWith('https://') &&
+        isAllowedHost(c.url) &&
         c.url.includes('/packages/generic/vyla-home/');
-      const url = direct ? c.url : (link && link.url);
+      const url = direct ? c.url : null;
       if (!url) {
-        throw new Error(`Release is missing asset ${c.file}.`);
+        throw new Error(`Release ${release.tag_name} manifest has no download URL for ${c.file}.`);
       }
       components[name] = { url, sha256: c.sha256, id: c.id, size: c.size };
     }