Existing behavior was to implicitly rely on http.DetectContentType to set the Content-Type, which specifically caused problems for files where the content doesn't adequately describe how the client should handle it. For example, APKs are technically ZIPs, but serving them as application/zip resulted in Android Firefox and Chrome saving them with a .apk.zip extension, requiring them to be renamed before install was possible.
This addresses that problem by serving all artifact blobs as application/octet-stream and ensuring Content-Disposition specifies the blob is an attachment to be downloaded, not rendered inline. Using Content-Disposition alone did not solve this problem in Firefox.
Setting the headers also required moving the WriteHeader call after them, which had been freezing the header map before those headers were set.
Note that https://tangled.org/tangled.org/core/pulls/2264 may be a better solution.
Co-authored-by: Claude (claude-opus-5) noreply@anthropic.com Signed-off-by: Ken-ichi Ueda kenichi.ueda@gmail.com