Initialize Clash Web source and deployment documentation

scripts/fetch-mihomo.py

@@ -0,0 +1,48 @@
+#!/usr/bin/env python3
+"""Download a pinned official release, verify GitHub's asset SHA256, and unpack it."""
+import argparse
+import gzip
+import hashlib
+import json
+import os
+import platform
+import tempfile
+import urllib.request
+from pathlib import Path
+
+parser = argparse.ArgumentParser()
+parser.add_argument('--version', default='v1.19.32')
+parser.add_argument('--output', default='bin/mihomo')
+args = parser.parse_args()
+machine = platform.machine()
+arch = {'x86_64': 'amd64-compatible', 'aarch64': 'arm64'}.get(machine)
+if arch is None:
+    raise SystemExit(f'Unsupported architecture: {machine}')
+if not args.version.startswith('v') or any(c not in 'v0123456789.' for c in args.version):
+    raise SystemExit('Use an explicit stable version such as v1.19.32')
+request = urllib.request.Request(f'https://api.github.com/repos/MetaCubeX/mihomo/releases/tags/{args.version}', headers={'User-Agent': 'ClashWeb-build'})
+with urllib.request.urlopen(request, timeout=30) as response:
+    release = json.load(response)
+name = f'mihomo-linux-{arch}-{args.version}.gz'
+asset = next((a for a in release['assets'] if a['name'] == name), None)
+if not asset or not asset.get('digest', '').startswith('sha256:'):
+    raise SystemExit('Release asset or authoritative SHA256 digest is missing; download aborted.')
+print(f'Downloading {name}', flush=True)
+with urllib.request.urlopen(asset['browser_download_url'], timeout=120) as response:
+    compressed = response.read(100 * 1024 * 1024 + 1)
+if len(compressed) > 100 * 1024 * 1024:
+    raise SystemExit('Asset exceeds download limit')
+if hashlib.sha256(compressed).hexdigest() != asset['digest'].split(':', 1)[1]:
+    raise SystemExit('SHA256 mismatch; download aborted')
+output = Path(args.output)
+output.parent.mkdir(parents=True, exist_ok=True)
+fd, temporary = tempfile.mkstemp(dir=output.parent, prefix='.mihomo-')
+try:
+    with os.fdopen(fd, 'wb') as stream:
+        stream.write(gzip.decompress(compressed))
+    os.chmod(temporary, 0o755)
+    os.replace(temporary, output)
+finally:
+    if os.path.exists(temporary):
+        os.unlink(temporary)
+print(f'Verified {asset["digest"]}; installed to {output}')