Download overview¶

TEBHOS serves every desktop build from one public prefix, https://tebhos.com/dl/. The prefix is handled by the API process but sits outside the versioned REST API: paths start at /dl, not at /api/v1. It serves files and release metadata only, needs no credential, and has no rate limit bucket.

The download button on the TEBHOS website and the auto-updater built into the desktop app both read from this prefix.

Channels¶

Every path names a release channel, either stable or canary. Each channel is published independently and has its own files and its own version history. Any other channel value returns 404.

What the prefix serves¶

There is no package repository (apt, dnf, pacman or Flatpak) on TEBHOS. Linux builds are published as direct downloads under /dl/desktop/, see Desktop builds.

What it guarantees¶

• Resumable downloads. Stored files are streamed with Accept-Ranges: bytes, ETag and Last-Modified, so a client can resume an interrupted download with Range and revalidate a cached file with If-None-Match or If-Modified-Since. HEAD is accepted on every file route.
• No directory listings. A path that does not name a file returns 404.
• Cache lifetimes follow mutability. Files pinned to a version never change once published and are cached for a year (Cache-Control: public, max-age=31536000). Release metadata and updater feeds, which change whenever a release ships, are cached for five minutes (public, max-age=300). The "latest build" download shortcut is never cached (no-store), so it always resolves to the newest release.
• Old versions stay available. Publishing a new release does not delete earlier files, so a version-pinned URL keeps working.

Errors use the standard error body of the HTTP API. An unknown channel, platform, architecture or format, a version that was never published, and a missing checksum all return 404 with code set to NOT_FOUND. A malformed file name returns 400.

Integrity¶

Every published installer or archive has a SHA-256 checksum, exposed both in the release metadata (sha256) and as a plain-text .sha256 sibling. Verify the checksum before running a downloaded file.