# Download page

`index.php` scans `bin/client` and `bin/server` on every request and renders
whatever builds it finds, with version, size and SHA-256. No database, no
JavaScript, no CSS, no dependencies. The page is plain browser defaults:
black text, blue links, monospace checksums. PHP 8.0+.

## Layout

```
web/
  index.php
  bin/client/    served at /bin/client/...
  bin/server/    served at /bin/server/...
```

Serve `web/` as the document root. Binaries in `bin/` are gitignored.

## Naming

The page only lists files that match the release pattern; anything else in
those directories is ignored.

```
zagan-bet-client-<version>-<platform>-<arch>[.exe]
zagan-bet-server-<version>-<platform>-<arch>
```

`<version>` is `MAJOR.MINOR.PATCH`, `<platform>` is `linux`, `windows` or
`macos`, `<arch>` is `x86_64`, `i686` or `aarch64`.

## Publishing a build

From the repository root:

```sh
./scripts/publish.sh
```

It reads the version from `Cargo.toml`, builds all four artifacts and installs
them under `web/bin` with the names above. Override the destination with
`DEST=/srv/www/bin ./scripts/publish.sh`.

Builds are per target triple, so these must be installed:
`x86_64-unknown-linux-gnu`, `i686-unknown-linux-gnu` and
`x86_64-pc-windows-gnu`, plus the mingw linker for the Windows build. Client
builds always pass `--no-default-features`, which drops the server's OpenSSL
dependency; the client is rustls-only.

Cargo itself cannot produce these names: it always writes
`target/<triple>/release/<bin>`. The script renames after each build.

## Preview locally

```sh
php -S 127.0.0.1:8899 -t web
```

Then open <http://127.0.0.1:8899/>.

## Deploying

```sh
./scripts/publish.sh
./scripts/deploy.sh user@host:/srv/zagan.bet https://zagan.bet/
```

`deploy.sh` rsyncs `web/` with `--delay-updates`, so a visitor never sees a
half-written binary, then fetches the live page and every artifact it lists and
compares the downloaded bytes with the local SHA-256. `--verify-only` skips the
upload and only checks the live site. Old versions are left on the server;
prune them by hand.

A local directory works as a target, which is how the verification itself is
tested:

```sh
php -S 127.0.0.1:8899 -t /srv/staging
./scripts/deploy.sh /srv/staging http://127.0.0.1:8899/
```

## Notes

- Hashes are cached in a JSON file keyed on size and mtime, so a file is only
  read once until it changes. The cache lives in the system temp directory by
  default because the web root is often not writable by the PHP user; set
  `ZAGAN_HASH_CACHE` to put it elsewhere. If the cache cannot be written, the
  page simply hashes every request.
- The page lists every build it finds, newest version first, so old releases
  stay downloadable until you remove them from `bin/`.
- The checksum block is in `sha256sum` format, so visitors can save it as
  `SHA256SUMS` and run `sha256sum -c SHA256SUMS`.