feat(build): add gzip-compressed binary downloads

Reduce download size from ~99 MB to ~37 MB (~60% reduction) for both
the install script and the CLI self-upgrade path.

Build script (CI only):
- Compress each binary with gzip level 6 via node:zlib after build
- Upload .gz files alongside raw binaries for backward compatibility

Upgrade path (src/lib/upgrade.ts):
- Try {url}.gz first with streaming DecompressionStream decompression
- Use manual for-await writer loop to work around Bun.write streaming
  bug (oven-sh/bun#13237)
- Fall back to raw binary download on any failure

Install script:
- Try curl | gunzip for .gz URL first (gunzip is POSIX-universal)
- Fall back to raw curl download for older releases without .gz assets

No CI or Craft config changes needed — existing globs already match .gz
files.

Author: BYK

install

@@ -104,7 +104,16 @@ tmp_binary="${tmpdir}/sentry-install-$$${suffix}"
 trap 'rm -f "$tmp_binary"' EXIT
 
 echo -e "${MUTED}Downloading sentry v${version}...${NC}"
-curl -fsSL --progress-bar "$url" -o "$tmp_binary"
+
+# Try gzip-compressed download first (~60% smaller, ~37 MB vs ~99 MB).
+# gunzip is POSIX and available on all Unix systems.
+# Falls back to raw binary if the .gz asset doesn't exist yet.
+if curl -fsSL "${url}.gz" 2>/dev/null | gunzip > "$tmp_binary" 2>/dev/null; then
+  : # Compressed download succeeded
+else
+  curl -fsSL --progress-bar "$url" -o "$tmp_binary"
+fi
+
 chmod +x "$tmp_binary"
 
 # Delegate installation and configuration to the binary itself.

script/build.ts

@@ -1,4 +1,5 @@
 #!/usr/bin/env bun
+
 /**
  * Build script for Sentry CLI
  *
@@ -19,9 +20,13 @@
  *     sentry-windows-x64.exe
  */
 
+import { promisify } from "node:util";
+import { gzip } from "node:zlib";
 import { $ } from "bun";
 import pkg from "../package.json";
 
+const gzipAsync = promisify(gzip);
+
 const VERSION = pkg.version;
 
 /** Build-time constants injected into the binary */
@@ -92,6 +97,20 @@ async function buildTarget(target: BuildTarget): Promise<boolean> {
   }
 
   console.log(`    -> ${outfile}`);
+
+  // In CI, create gzip-compressed copies for release downloads.
+  // Reduces download size by ~60% (99 MB → 37 MB).
+  if (process.env.CI) {
+    const binary = await Bun.file(outfile).arrayBuffer();
+    const compressed = await gzipAsync(Buffer.from(binary), { level: 6 });
+    await Bun.write(`${outfile}.gz`, compressed);
+    const ratio = (
+      (1 - compressed.byteLength / binary.byteLength) *
+      100
+    ).toFixed(0);
+    console.log(`    -> ${outfile}.gz (${ratio}% smaller)`);
+  }
+
   return true;
 }
 

src/lib/upgrade.ts

@@ -341,10 +341,37 @@ export type DownloadResult = {
   lockPath: string;
 };
 
+/**
+ * Stream a response body through a decompression transform and write to disk.
+ *
+ * Uses a manual `for await` loop with `Bun.file().writer()` instead of
+ * `Bun.write(path, Response)` to work around a Bun event-loop bug where
+ * streaming response bodies get GC'd before completing.
+ * See: https://github.com/oven-sh/bun/issues/13237
+ *
+ * @param body - Readable stream from a fetch response
+ * @param destPath - File path to write the decompressed output
+ */
+async function streamDecompressToFile(
+  body: ReadableStream<Uint8Array>,
+  destPath: string
+): Promise<void> {
+  const stream = body.pipeThrough(new DecompressionStream("gzip"));
+  const writer = Bun.file(destPath).writer();
+  for await (const chunk of stream) {
+    writer.write(chunk);
+  }
+  await writer.end();
+}
+
 /**
  * Download the new binary to a temporary path and return its location.
  * Used by the upgrade command to download before spawning setup --install.
  *
+ * Tries the gzip-compressed URL first (`{url}.gz`, ~37 MB vs ~99 MB),
+ * falling back to the raw binary URL on any failure. The compressed
+ * download is streamed through DecompressionStream for minimal memory usage.
+ *
  * The lock is held on success so concurrent upgrades are blocked during the
  * download→spawn→install pipeline. The caller MUST release the lock after the
  * child process exits (the child may use a different install directory and
@@ -374,26 +401,42 @@ export async function downloadBinaryToTemp(
       // Ignore if doesn't exist
     }
 
-    // Download binary
-    const response = await fetchWithUpgradeError(
-      url,
-      { headers: getGitHubHeaders() },
-      "GitHub"
-    );
+    const headers = getGitHubHeaders();
 
-    if (!response.ok) {
-      throw new UpgradeError(
-        "execution_failed",
-        `Failed to download binary: HTTP ${response.status}`
+    // Try gzip-compressed download first (~60% smaller)
+    let downloaded = false;
+    try {
+      const gzResponse = await fetchWithUpgradeError(
+        `${url}.gz`,
+        { headers },
+        "GitHub"
       );
+      if (gzResponse.ok && gzResponse.body) {
+        await streamDecompressToFile(gzResponse.body, tempPath);
+        downloaded = true;
+      }
+    } catch {
+      // Fall through to raw download
     }
 
-    // Fully consume the response body before writing to disk.
-    // Bun.write(path, Response) with a large streaming body can exit the
-    // process before the download completes (Bun event-loop bug).
-    // Materialising the body first ensures the await keeps the process alive.
-    const body = await response.arrayBuffer();
-    await Bun.write(tempPath, body);
+    // Fall back to raw (uncompressed) binary
+    if (!downloaded) {
+      const response = await fetchWithUpgradeError(url, { headers }, "GitHub");
+
+      if (!response.ok) {
+        throw new UpgradeError(
+          "execution_failed",
+          `Failed to download binary: HTTP ${response.status}`
+        );
+      }
+
+      // Fully consume the response body before writing to disk.
+      // Bun.write(path, Response) with a large streaming body can exit the
+      // process before the download completes (Bun event-loop bug).
+      // See: https://github.com/oven-sh/bun/issues/13237
+      const body = await response.arrayBuffer();
+      await Bun.write(tempPath, body);
+    }
 
     // Set executable permission (Unix only)
     if (process.platform !== "win32") {

test/lib/upgrade.test.ts

@@ -662,20 +662,22 @@ describe("executeUpgrade with curl method", () => {
     }
   });
 
-  test("executeUpgrade curl downloads binary to temp path", async () => {
+  test("downloads and decompresses gzip binary when .gz URL succeeds", async () => {
     const mockBinaryContent = new Uint8Array([0x7f, 0x45, 0x4c, 0x46]); // ELF magic bytes
 
-    // Mock fetch to return our fake binary
-    mockFetch(async () => new Response(mockBinaryContent, { status: 200 }));
+    // Compress the mock content with gzip
+    const gzipped = Bun.gzipSync(mockBinaryContent);
+
+    // Mock fetch: first call returns gzipped content (.gz URL)
+    mockFetch(async () => new Response(gzipped, { status: 200 }));
 
-    // Run the actual executeUpgrade with curl method — returns DownloadResult
     const result = await executeUpgrade("curl", "1.0.0");
 
     expect(result).not.toBeNull();
     expect(result).toHaveProperty("tempBinaryPath");
     expect(result).toHaveProperty("lockPath");
 
-    // Verify the binary was downloaded to the temp path
+    // Verify the decompressed binary matches the original content
     const paths = getTestPaths();
     expect(result!.tempBinaryPath).toBe(paths.tempPath);
     expect(result!.lockPath).toBe(paths.lockPath);
@@ -684,7 +686,54 @@ describe("executeUpgrade with curl method", () => {
     expect(new Uint8Array(content)).toEqual(mockBinaryContent);
   });
 
-  test("executeUpgrade curl throws on HTTP error", async () => {
+  test("falls back to raw binary when .gz URL returns 404", async () => {
+    const mockBinaryContent = new Uint8Array([0x7f, 0x45, 0x4c, 0x46]); // ELF magic bytes
+    let callCount = 0;
+
+    // Mock fetch: first call (for .gz) returns 404, second returns raw binary
+    mockFetch(async () => {
+      callCount += 1;
+      if (callCount === 1) {
+        return new Response("Not Found", { status: 404 });
+      }
+      return new Response(mockBinaryContent, { status: 200 });
+    });
+
+    const result = await executeUpgrade("curl", "1.0.0");
+
+    expect(result).not.toBeNull();
+    expect(callCount).toBe(2); // Both .gz and raw URL were tried
+
+    // Verify the binary was downloaded
+    expect(await Bun.file(result!.tempBinaryPath).exists()).toBe(true);
+    const content = await Bun.file(result!.tempBinaryPath).arrayBuffer();
+    expect(new Uint8Array(content)).toEqual(mockBinaryContent);
+  });
+
+  test("falls back to raw binary when .gz fetch throws network error", async () => {
+    const mockBinaryContent = new Uint8Array([0x7f, 0x45, 0x4c, 0x46]);
+    let callCount = 0;
+
+    // Mock fetch: first call throws, second returns raw binary
+    mockFetch(async () => {
+      callCount += 1;
+      if (callCount === 1) {
+        throw new TypeError("fetch failed");
+      }
+      return new Response(mockBinaryContent, { status: 200 });
+    });
+
+    const result = await executeUpgrade("curl", "1.0.0");
+
+    expect(result).not.toBeNull();
+    expect(callCount).toBe(2);
+
+    const content = await Bun.file(result!.tempBinaryPath).arrayBuffer();
+    expect(new Uint8Array(content)).toEqual(mockBinaryContent);
+  });
+
+  test("throws on HTTP error when both .gz and raw URLs fail", async () => {
+    // Both .gz and raw return errors
     mockFetch(async () => new Response("Not Found", { status: 404 }));
 
     await expect(executeUpgrade("curl", "99.99.99")).rejects.toThrow(
@@ -695,7 +744,7 @@ describe("executeUpgrade with curl method", () => {
     );
   });
 
-  test("executeUpgrade curl throws on network failure", async () => {
+  test("throws on network failure when both .gz and raw URLs fail", async () => {
     mockFetch(async () => {
       throw new TypeError("fetch failed");
     });
@@ -706,7 +755,7 @@ describe("executeUpgrade with curl method", () => {
     );
   });
 
-  test("executeUpgrade curl releases lock on failure", async () => {
+  test("releases lock on failure", async () => {
     mockFetch(async () => new Response("Server Error", { status: 500 }));
 
     try {