Releases carry their source (oh-VERSION-src.tar.gz, subrepos inside) and assets have a fixed address, /OWNER/NAME/releases/download/TAG/FILE (refs andymccall/oxygen#157) 93f445fa50d8

        artifact "oh-src.tar.gz" {

            path "/src/target/dist-flat/oh-src.tar.gz"

        }

- **A release's asset at a fixed address (oxygen#157).** `/OWNER/NAME/releases/download/TAG/FILE` redirects to the asset, an address known before the release exists (as GitHub's), so a packager's recipe can name it.

- **Releases carry their source (oxygen#157).** Each release now has `oh-VERSION-src.tar.gz`: the oxygenhub tree with its subrepos inside, so oh builds from it alone, reproducible and listed in SHA256SUMS, for packagers (haikuports' oh recipe).

        .route("/{owner}/{name}/releases/download/{tag}/{file}", get(releases::download_by_tag))

/// `GET /{owner}/{name}/releases/download/{tag}/{file}` (oxygen#157): a

/// release's asset by its tag and file name, a URL known before the release

/// exists (as GitHub's), for packagers' recipes; redirected to the asset.

pub async fn download_by_tag(

    State(app): State<Shared>,

    viewer: Viewer,

    Path((owner, name, tag, file)): Path<(String, String, String, String)>,

) -> Result<Response, Error> {

    let shell = Shell::new(&app, &format!("/{owner}/{name}/releases"), &viewer);

    let (_, row, _) = lookup(&app, &shell, &viewer, &owner, &name).await?;

    let e = |e| Error::from_db(shell.clone(), e);

    let release = rdb::get(&app.db, row.id, &tag).await.map_err(e)?.ok_or_else(|| Error::not_found(shell.clone()))?;

    let asset = rdb::asset(&app.db, release.id, &file).await.map_err(e)?.ok_or_else(|| Error::not_found(shell.clone()))?;

    Ok(Redirect::to(&format!("/{owner}/{name}/asset/{}/{}", asset.id, asset.name)).into_response())

}

    // By tag and name too, at a URL known before the release exists, for

    // packagers' recipes (oxygen#157): redirected to the asset.

    let by_tag = send(app, "GET", "/andy/demo/releases/download/v0.2/demo-linux.bin", None, None, None, vec![]).await;

    assert_eq!(by_tag.location.as_deref(), Some(url.as_str()));

    let none = send(app, "GET", "/andy/demo/releases/download/v0.2/nope.bin", None, None, None, vec![]).await;

    assert_eq!(none.status, StatusCode::NOT_FOUND);

# The source as released (oxygen#157): the oxygenhub tree with its subrepos (deps/), so oh builds from it alone,

# under oxygenhub-VERSION/, for packagers (haikuports) to fetch from the

# release at a fixed checksum. Reproducible: sorted, fixed times and

# owners, gzip without a timestamp.

if [ -z "${ONLY:-}" ] || [[ src == $ONLY ]]; then

  echo "== src"

  tar --sort=name --mtime='1970-01-01 00:00:00Z' --owner=0 --group=0 --numeric-owner \

    --mode='u+rwX,go+rX,go-w' --exclude=./target --exclude=.oxy \

    --transform "s|^\.|oxygenhub-$VERSION|" -cf - . | gzip -9n >"$OUT/$BIN-$VERSION-src.tar.gz"

fi