Use HTTPS for same-origin Gitea release downloads

scripts/publish_pack.py

@@ -15,7 +15,7 @@ import subprocess
 import sys
 import tempfile
 from urllib.error import HTTPError, URLError
-from urllib.parse import quote, urlsplit
+from urllib.parse import quote, urlsplit, urlunsplit
 from urllib.request import HTTPRedirectHandler, Request, build_opener, urlopen
 import uuid
 import zipfile
@@ -95,7 +95,12 @@ class Gitea:
                                  'POST', payload,
                                  content_type='multipart/form-data; boundary=' + boundary)
             release['assets'].append(asset)
-        asset_url = pack.https_url(asset['browser_download_url'])
+        # Some reverse-proxied Gitea installations advertise HTTP despite their
+        # public HTTPS origin. Upgrade only this same-origin URL, then verify it.
+        advertised = urlsplit(asset['browser_download_url'])
+        if advertised.scheme == 'http' and advertised.netloc == urlsplit(self.repo_url).netloc:
+            advertised = advertised._replace(scheme='https')
+        asset_url = pack.https_url(urlunsplit(advertised))
         # Verify anonymous access: players must not need publishing credentials.
         with urlopen(asset_url, timeout=60) as response:
             digest = hashlib.sha256(response.read()).hexdigest()