From 7e362ef962880afa6ecda72d7ff6624363374f0e Mon Sep 17 00:00:00 2001
From: CRT <hi@crt.fyi>
Date: Sun, 8 Nov 2026 18:20:36 +0700
Subject: [PATCH] ci: AppImage tools from the Forgejo mirror (sha256-checked)
 into ~/.cache/tauri; GitHub release assets fail too often

---
 .forgejo/workflows/ci.yml |  2 ++
 CHANGELOG.md              |  2 ++
 tools/ci-tauri-tools.sh   | 13 +++++++++++++
 3 files changed, 17 insertions(+)
 create mode 100755 tools/ci-tauri-tools.sh

diff --git a/.forgejo/workflows/ci.yml b/.forgejo/workflows/ci.yml
index b411154..656ac95 100644
--- a/.forgejo/workflows/ci.yml
+++ b/.forgejo/workflows/ci.yml
@@ -174,6 +174,7 @@ jobs:
         run: |
           rm -rf "$CARGO_TARGET_DIR/release/bundle"
           # the AppImage tools come from GitHub releases, which answer 504 now and then (cached in ~/.cache/tauri)
+          bash ../../tools/ci-tauri-tools.sh
           for i in 1 2 3; do bun ../../tools/desktop-release.ts exec -- bunx tauri build --bundles appimage,deb --ci && break; [ $i = 3 ] && exit 1; sleep 30; done
       - name: Self-test the exact artifacts
         run: |
@@ -238,6 +239,7 @@ jobs:
           bun tools/build-sidecars.ts --target bun-linux-x64
           patchelf --set-rpath '$ORIGIN/../lib' apps/desktop/src-tauri/binaries/storebound-x86_64-unknown-linux-gnu
           B="$CARGO_TARGET_DIR/release/bundle"; rm -rf "$B"
+          bash tools/ci-tauri-tools.sh
           for i in 1 2 3; do (cd apps/desktop && bun ../../tools/desktop-release.ts exec -- bunx tauri build --bundles appimage,deb --ci) && break; [ $i = 3 ] && exit 1; sleep 30; done
           mkdir -p dev && cp "$B/appimage/storebound_${V}_amd64.AppImage" "$B/deb/storebound_${V}_amd64.deb" dev/
           chmod +x dev/*.AppImage
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 37bd801..695db9b 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -3,6 +3,8 @@
 
 ## Unreleased
 
+- 0.8.75 was tagged but not published (GitHub 502/504 in the Linux AppImage bundling). CI now takes the AppImage tools from a checked mirror instead of GitHub.
+
 ## 0.8.75 · 2026-11-08
 
 - 0.8.74 was tagged but not published (GitHub release downloads answered 504 during the Linux AppImage bundling); 0.8.75 ships its section.
diff --git a/tools/ci-tauri-tools.sh b/tools/ci-tauri-tools.sh
new file mode 100755
index 0000000..63f6841
--- /dev/null
+++ b/tools/ci-tauri-tools.sh
@@ -0,0 +1,13 @@
+#!/usr/bin/env bash
+# Puts the AppImage tools Tauri's bundler would download from GitHub releases (which answer 502/504 now and then) into
+# ~/.cache/tauri from our Forgejo package mirror, checked against its SHA256SUMS. Tauri skips the download when they exist.
+set -eu
+B="${TAURI_TOOLS_MIRROR:-https://git.crt.fyi/api/packages/CRT/generic/tauri-linux-tools/2026.11.08}"
+D="$HOME/.cache/tauri"; mkdir -p "$D"; cd "$D"
+curl -fsSL --retry 3 --max-time 60 -o SHA256SUMS "$B/SHA256SUMS"
+while read -r sum f; do
+  f="${f#\*}"
+  if ! echo "$sum  $f" | sha256sum -c --status 2>/dev/null; then curl -fsSL --retry 3 --max-time 300 -o "$f" "$B/$f"; echo "$sum  $f" | sha256sum -c --status; fi
+  chmod +x "$f"
+done < SHA256SUMS
+rm -f SHA256SUMS; ls "$D"