Pin installer and updater downloads to the builds tip commit.

raw.githubusercontent.com caches branch-named files, so the installer was serving a stale zip after CI rewrote builds.

Co-authored-by: Cursor <cursoragent@cursor.com>

installers/maturita-installer-linux.sh

@@ -1,9 +1,9 @@
 #!/bin/sh
 # maturita.c installer for Linux.
 #
-# Carries no application of its own: it downloads the current build straight
-# from the repository's `builds` branch, which CI rewrites whenever main
-# changes. This file therefore never goes stale.
+# Carries no application of its own. Fastly caches branch-named URLs on
+# raw.githubusercontent.com, so this script looks up the tip of `builds`
+# and downloads that commit — not a stale AppImage from the last five minutes.
 #
 # Run it with:  sh maturita-installer-linux.sh
 # The app updates itself from then on.
@@ -13,10 +13,7 @@ set -eu
 REPO="pepaskopec-blip/maturita.c"
 BRANCH="builds"
 ASSET="maturita-linux-x86_64.AppImage"
-URL="https://raw.githubusercontent.com/$REPO/$BRANCH/$ASSET"
 
-# ~/Applications is where desktop environments look for AppImages, and the app
-# keeps its progress/ directory next to its own file.
 DEST_DIR="$HOME/Applications"
 DEST="$DEST_DIR/maturita.AppImage"
 DESKTOP_DIR="$HOME/.local/share/applications"
@@ -25,6 +22,13 @@ ICON_DIR="$HOME/.local/share/icons/hicolor/512x512/apps"
 say() { printf '%s\n' "$*"; }
 die() { printf '\nError: %s\n' "$*" >&2; exit 1; }
 
+builds_sha() {
+    curl -fsSL --max-time 20 \
+        "https://github.com/$REPO/commits/$BRANCH.atom" |
+        sed -n 's/.*Commit\/\([0-9a-f]\{40\}\).*/\1/p' |
+        head -n 1
+}
+
 say "Installing maturita.C"
 say "---------------------"
 
@@ -41,16 +45,19 @@ mkdir -p "$DEST_DIR"
 tmp=$(mktemp -d)
 trap 'rm -rf "$tmp"' EXIT INT TERM
 
-say "Downloading the latest build..."
-curl -fL --progress-bar -o "$tmp/$ASSET" "$URL" ||
+say "Looking up the latest build..."
+sha=$(builds_sha)
+[ ${#sha} -eq 40 ] || die "could not find the latest build on GitHub."
+URL="https://raw.githubusercontent.com/$REPO/$sha/$ASSET"
+
+say "Downloading build $(printf '%.7s' "$sha")..."
+curl -fL --progress-bar --max-time 1800 -o "$tmp/$ASSET" "$URL" ||
     die "the download failed. Check your internet connection."
 
 say "Installing to $DEST"
 chmod +x "$tmp/$ASSET"
 mv -f "$tmp/$ASSET" "$DEST" || die "could not write to $DEST_DIR."
 
-# A menu entry needs the icon as a separate file, which the AppImage can
-# unpack without FUSE. Losing the icon is not worth failing the install over.
 if (cd "$tmp" && "$DEST" --appimage-extract \
         'usr/share/icons/hicolor/512x512/apps/maturita.png' >/dev/null 2>&1); then
     icon="$tmp/squashfs-root/usr/share/icons/hicolor/512x512/apps/maturita.png"

installers/maturita-installer-macos.command

@@ -1,9 +1,9 @@
 #!/bin/sh
 # maturita.c installer for macOS.
 #
-# Carries no application of its own: it downloads the current build straight
-# from the repository's `builds` branch, which CI rewrites whenever main
-# changes. This file therefore never goes stale.
+# Carries no application of its own. Fastly caches branch-named URLs on
+# raw.githubusercontent.com, so this script looks up the tip of `builds`
+# and downloads that commit — not a stale zip from the last five minutes.
 #
 # Double-click the file to run it. The app updates itself from then on.
 
@@ -12,15 +12,21 @@ set -eu
 REPO="pepaskopec-blip/maturita.c"
 BRANCH="builds"
 ASSET="maturita-macos-arm64.zip"
-URL="https://raw.githubusercontent.com/$REPO/$BRANCH/$ASSET"
 
 say() { printf '%s\n' "$*"; }
 die() { printf '\nError: %s\n' "$*" >&2; printf 'Press Return to close. '; read -r _; exit 1; }
 
+# Atom feed of the builds branch: curl only, no GitHub API token.
+builds_sha() {
+    curl -fsSL --max-time 20 \
+        "https://github.com/$REPO/commits/$BRANCH.atom" |
+        sed -n 's/.*Commit\/\([0-9a-f]\{40\}\).*/\1/p' |
+        head -n 1
+}
+
 say "Installing maturita.C"
 say "---------------------"
 
-# Only Apple Silicon builds are published; Rosetta cannot run an arm64 app.
 arch=$(uname -m)
 if [ "$arch" != "arm64" ]; then
     die "this build is for Apple Silicon Macs, but this one reports '$arch'.
@@ -29,7 +35,6 @@ fi
 
 command -v curl >/dev/null 2>&1 || die "curl was not found."
 
-# Prefer the shared folder, fall back to the user's own when it is locked down.
 if [ -w /Applications ]; then
     dest_dir="/Applications"
 else
@@ -40,13 +45,17 @@ fi
 tmp=$(mktemp -d)
 trap 'rm -rf "$tmp"' EXIT INT TERM
 
-say "Downloading the latest build..."
-curl -fL --progress-bar -o "$tmp/$ASSET" "$URL" ||
+say "Looking up the latest build..."
+sha=$(builds_sha)
+[ ${#sha} -eq 40 ] || die "could not find the latest build on GitHub."
+URL="https://raw.githubusercontent.com/$REPO/$sha/$ASSET"
+
+say "Downloading build $(printf '%.7s' "$sha")..."
+curl -fL --progress-bar --max-time 1800 -o "$tmp/$ASSET" "$URL" ||
     die "the download failed. Check your internet connection."
 
 say "Unpacking..."
 mkdir -p "$tmp/new"
-# ditto keeps bundle symlinks and permissions intact, unlike plain unzip.
 ditto -x -k "$tmp/$ASSET" "$tmp/new" || die "the archive could not be unpacked."
 
 app=$(find "$tmp/new" -maxdepth 1 -name '*.app' -print -quit)
@@ -61,13 +70,10 @@ fi
 if mv "$app" "$dest_dir/$name"; then
     rm -rf "$dest_dir/$name.old"
 else
-    # Put the previous copy back rather than leaving nothing installed.
     [ -e "$dest_dir/$name.old" ] && mv "$dest_dir/$name.old" "$dest_dir/$name"
     die "could not write to $dest_dir."
 fi
 
-# The download carries a quarantine flag, and the app is not signed, so
-# without this macOS refuses to open it.
 xattr -cr "$dest_dir/$name" 2>/dev/null || true
 
 say ""

installers/maturita-installer-windows.cmd

@@ -1,23 +1,21 @@
 @echo off
 rem maturita.c installer for Windows.
 rem
-rem Carries no application of its own: it downloads the current build straight
-rem from the repository's `builds` branch, which CI rewrites whenever main
-rem changes. This file therefore never goes stale.
+rem Carries no application of its own. Fastly caches branch-named URLs on
+rem raw.githubusercontent.com, so this script looks up the tip of `builds`
+rem and downloads that commit — not a stale zip from the last five minutes.
 rem
 rem Double-click the file to run it. The app updates itself from then on.
 
-setlocal
+setlocal EnableDelayedExpansion
 set "REPO=pepaskopec-blip/maturita.c"
 set "BRANCH=builds"
 set "ASSET=maturita-windows-x64.zip"
-set "URL=https://raw.githubusercontent.com/%REPO%/%BRANCH%/%ASSET%"
 set "DEST=%LOCALAPPDATA%\Programs\Maturita"
 
 echo Installing maturita.C
 echo ---------------------
 
-rem curl and tar both ship with Windows 10 1803 and later.
 where curl >nul 2>&1 || goto :no_tools
 where tar  >nul 2>&1 || goto :no_tools
 
@@ -25,17 +23,20 @@ set "TMP_DIR=%TEMP%\maturita-installer"
 rmdir /s /q "%TMP_DIR%" 2>nul
 mkdir "%TMP_DIR%" || goto :fail_tmp
 
-echo Downloading the latest build...
-curl -fL --progress-bar -o "%TMP_DIR%\%ASSET%" "%URL%" || goto :fail_download
+echo Looking up the latest build...
+set "SHA="
+for /f "usebackq delims=" %%S in (`powershell -NoProfile -ExecutionPolicy Bypass -Command "$r = & curl.exe -fsSL --max-time 20 'https://github.com/%REPO%/commits/%BRANCH%.atom'; if ($r -match 'Commit/([0-9a-f]{40})') { $Matches[1] }"`) do set "SHA=%%S"
+if not defined SHA goto :fail_download
+set "URL=https://raw.githubusercontent.com/%REPO%/%SHA%/%ASSET%"
+
+echo Downloading build %SHA:~0,7%...
+curl -fL --progress-bar --max-time 1800 -o "%TMP_DIR%\%ASSET%" "%URL%" || goto :fail_download
 
 echo Installing to %DEST%
 if not exist "%DEST%" mkdir "%DEST%" || goto :fail_dest
 
-rem Extracted over any existing install rather than replacing the folder, so
-rem the progress files kept inside it survive an upgrade.
 tar -xf "%TMP_DIR%\%ASSET%" -C "%DEST%" || goto :fail_extract
 
-rem Start menu entry, so the app can be found without digging for the folder.
 set "LNK=%APPDATA%\Microsoft\Windows\Start Menu\Programs\maturita.C.lnk"
 powershell -NoProfile -ExecutionPolicy Bypass -Command ^
   "$s=(New-Object -ComObject WScript.Shell).CreateShortcut('%LNK%');" ^