vyla-entertainment/Home
2
0
Fork 0
mirror of https://gitlab.com/vyla-entertainment/home.git synced 2026-11-13 21:57:21 -05:00
Code Issues Packages Projects Releases Wiki Activity

fix: enforce manifest-based component downloads and validate package URLs during release builds

Browse Source
This commit is contained in:
mesmerize
2026-11-04 21:30:54 -08:00
parent b0096a2073
commit a506a2efb4
2 changed files with 7 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
update-client.js
View File

@@ -379,13 +379,13 @@ class UpdateClient {
const components = {};
for (const [name, c] of Object.entries(manifest.components)) {
const link = links.find((a) => a.name === c.file);
const direct = typeof c.url === 'string' &&
c.url.startsWith('https://gitlab.com/api/v4/projects/') &&
c.url.startsWith('https://') &&
isAllowedHost(c.url) &&
c.url.includes('/packages/generic/vyla-home/');
const url = direct ? c.url : (link && link.url);
const url = direct ? c.url : null;
if (!url) {
throw new Error(`Release is missing asset ${c.file}.`);
throw new Error(`Release ${release.tag_name} manifest has no download URL for ${c.file}.`);
}
components[name] = { url, sha256: c.sha256, id: c.id, size: c.size };
}