psa-orderform/update-server/package.php

<?php

declare(strict_types=1);

require_once __DIR__ . "/includes/update-server.php";

$baseDir = __DIR__;
$manifestFile = $baseDir . "/manifest.json";

try {
    $version = trim((string) ($_GET["version"] ?? ""));
    if (!updateServerVersionIsValid($version)) {
        updateServerTextResponse(400, "Invalid version.");
    }

    $manifest = updateServerReadManifest($manifestFile);
    $release = updateServerReleaseByVersion($manifest, $version);
    $packagePath = updateServerPackagePath($baseDir, $release["package"]);

    if (strtolower(pathinfo($packagePath, PATHINFO_EXTENSION)) !== "zip") {
        throw new RuntimeException("Release package is not a ZIP file.");
    }

    $fileName = basename($packagePath);
    $fileSize = filesize($packagePath);
    $handle = fopen($packagePath, "rb");
    if ($fileSize === false || $handle === false) {
        throw new RuntimeException("Release package cannot be opened.");
    }

    header("Content-Type: application/zip");
    header("Content-Disposition: attachment; filename=\"" . addcslashes($fileName, "\"\\") . "\"");
    header("Content-Length: " . (string) $fileSize);
    header("Cache-Control: public, max-age=300");
    header("X-Content-Type-Options: nosniff");

    fpassthru($handle);
    fclose($handle);
} catch (Throwable $exception) {
    $message = $exception->getMessage();
    $status = in_array($message, [
        "Release is not configured.",
        "Release package is missing.",
    ], true) ? 404 : 500;

    updateServerTextResponse($status, $message);
}