# `MishkaInstaller.Installer.Downloader`
[🔗](https://github.com/mishka-group/mishka_installer/blob/v0.1.14/lib/installer/downloader.ex#L1)

The `MishkaInstaller.Installer.Downloader` module downloads a **pre-built artifact** — a `tar.gz`
that contains a compiled `ebin` directory (`ebin/*.beam` + `ebin/<app>.app`).

> It deliberately does **not** download source to be compiled at runtime. Compiling cannot work
> in a production `release` (no `Mix`/`Hex`/source/`_build`), so the publisher is expected to
> attach the **already compiled** artifact (typically a **GitHub release** asset, a CDN, or any URL).

Supported sources:

- `:url` — a direct artifact URL (a GitHub release asset URL, an S3/CDN link, ...).
- `:github_tag` — resolve the asset of a specific release **tag** via the GitHub API.
- `:github_latest_release` — resolve the asset of the **latest** release via the GitHub API.

> #### Security considerations {: .warning}
>
> It is important to remember that all of the functionalities contained within this
> section must be implemented at the **high access level**, and they should not directly take
> any input from the user. Ensure that you include the required safety measures.
>
> A downloaded artifact is loaded as code with full node privileges; only download from trusted
> sources and verify its provenance/integrity before activation.

# `download_type`

```elixir
@type download_type() :: :url | :github_tag | :github_latest_release
```

# `error_return`

```elixir
@type error_return() ::
  {:error, [%{action: atom(), field: atom(), message: String.t()}]}
```

# `okey_return`

```elixir
@type okey_return() :: {:ok, binary()}
```

# `pkg`

```elixir
@type pkg() ::
  %{path: String.t()}
  | %{path: String.t(), tag: String.t()}
  | %{path: String.t(), asset: String.t()}
```

# `download`

```elixir
@spec download(download_type(), pkg()) :: okey_return() | error_return()
```

Downloads a pre-built artifact (a `tar.gz` containing the compiled `ebin`) from the given source.

> #### Security considerations {: .warning}
>
> It is important to remember that all of the functionalities contained within this
> section must be implemented at the **high access level**, and they should not directly take
> any input from the user. Ensure that you include the required safety measures.

### Example:
```elixir
download(:url, %{path: "https://github.com/owner/repo/releases/download/0.1.0/app-0.1.0-ebin.tar.gz"})
download(:github_tag, %{path: "owner/repo", tag: "0.1.0"})
download(:github_tag, %{path: "owner/repo", tag: "0.1.0", asset: "app-ebin.tar.gz"})
download(:github_latest_release, %{path: "owner/repo"})
```

---

*Consult [api-reference.md](api-reference.md) for complete listing*