chore: padroniza arquitetura Ciberfauna, elevação root na abertura e CI multi-arch no runner ARM

scripts/make-latest-json.py

@@ -11,15 +11,16 @@ Precisa de API (URL do repositório na API do Gitea) e TOKEN no ambiente.
 import json
 import os
 import sys
+import urllib.parse
 import urllib.request
 from datetime import datetime, timezone
 
 # (chaves de plataforma, padrão do nome do pacote). {v} = versão sem o "v".
 # Sem macOS: não há runner para compilar essa plataforma.
 PLATFORMS = [
-    (["linux-x86_64", "linux-x86_64-appimage"], "Guara_{v}_amd64.AppImage"),
-    (["linux-aarch64", "linux-aarch64-appimage"], "Guara_{v}_aarch64.AppImage"),
-    (["windows-x86_64", "windows-x86_64-nsis"], "Guara_{v}_x64-setup.exe"),
+    (["linux-x86_64", "linux-x86_64-appimage"], ("Guará_{v}_amd64.AppImage", "Guara_{v}_amd64.AppImage")),
+    (["linux-aarch64", "linux-aarch64-appimage"], ("Guará_{v}_aarch64.AppImage", "Guara_{v}_aarch64.AppImage")),
+    (["windows-x86_64", "windows-x86_64-nsis"], ("Guará_{v}_x64-setup.exe", "Guara_{v}_x64-setup.exe")),
 ]
 
 
@@ -29,7 +30,8 @@ def api_get(path):
 
 
 def api_get_text(url):
-    req = urllib.request.Request(url, headers={"Authorization": f"token {os.environ['TOKEN']}"})
+    safe_url = urllib.parse.quote(url, safe=":/?&=%")
+    req = urllib.request.Request(safe_url, headers={"Authorization": f"token {os.environ['TOKEN']}"})
     return urllib.request.urlopen(req).read().decode()
 
 
@@ -38,9 +40,9 @@ def build(version, notes, assets, pub_date):
 
     Plataforma sem pacote ou sem assinatura sai da lista; o chamador decide se isso é erro."""
     platforms = {}
-    for keys, pattern in PLATFORMS:
-        name = pattern.format(v=version)
-        if name not in assets:
+    for keys, patterns in PLATFORMS:
+        name = next((n for p in patterns if (n := p.format(v=version)) in assets), None)
+        if name is None:
             continue
         url, sig = assets[name]
         for k in keys:
@@ -54,20 +56,22 @@ def main():
     rel = api_get(f"/releases/tags/{tag}")
     by_name = {a["name"]: a for a in rel["assets"]}
     assets = {}
-    for _, pattern in PLATFORMS:
-        name = pattern.format(v=version)
+    for _, patterns in PLATFORMS:
+        name = next((n for p in patterns if (n := p.format(v=version)) in by_name), None)
+        if name is None:
+            continue
         sig_name = name + ".sig"
-        if name in by_name and sig_name in by_name:
+        if sig_name in by_name:
             sig = api_get_text(by_name[sig_name]["browser_download_url"])
             assets[name] = (by_name[name]["browser_download_url"], sig)
     data = build(version, open(notes_path, encoding="utf-8").read(), assets,
                  datetime.now(timezone.utc).strftime("%Y-%m-%dT%H:%M:%SZ"))
-    # O CI gera o Linux aarch64 (o runner é arm64); o x86_64 vem de uma máquina x86_64 e
-    # entra depois (scripts/build-gui.sh linux). Exige o Windows e ao menos um Linux.
+    # Exige os pacotes assinados de Linux (x86_64 e aarch64) e Windows.
     platforms = data["platforms"]
-    if "windows-x86_64" not in platforms or not any(k.startswith("linux-") for k in platforms):
-        sys.exit(f"faltam pacotes ou assinaturas (achei {sorted(platforms)}); "
-                 "confira se TAURI_SIGNING_PRIVATE_KEY está nos segredos")
+    for must in ("linux-x86_64", "linux-aarch64", "windows-x86_64"):
+        if must not in platforms:
+            sys.exit(f"faltam pacotes ou assinaturas de {must} (achei {sorted(platforms)}); "
+                     "confira se TAURI_SIGNING_PRIVATE_KEY está nos segredos")
     with open(out, "w", encoding="utf-8") as f:
         json.dump(data, f, indent=2, ensure_ascii=False)
         f.write("\n")