✍️ Description

Pangolin has a branch and tag with the same name (1.12.3). GitHub's tarball_url returns HTTP 300 (not a redirect), so curl saves JSON instead of the tarball → "gzip: stdin: not in gzip format".

Fixed / Improved -> Use explicit refs/tags URL which always returns a proper redirect:

https://github.com/$repo/archive/refs/tags/$tag_name.tar.gz

Example:

GET https://api.github.com/repos/fosrl/pangolin/tarball/1.12.3

HTTP/2 300
{
  "message": "Multiple resource types were returned for this ref",
  "resources": [
    {"type": "branch", "url": ".../refs/heads/1.12.3"},
    {"type": "tag", "url": ".../refs/tags/1.12.3"}
  ]
}

curl -fsSL doesn't follow 300 responses (only 301/302), so it saves the JSON body as the file → tar -xzf fails with "gzip: stdin: not in gzip format".

🔗 Related PR / Issue

Link: #9694

✅ Prerequisites (X in brackets)

• Self-review completed – Code follows project standards.
• Tested thoroughly – Changes work as expected.
• No security risks – No hardcoded secrets, unnecessary privilege escalations, or permission issues.

🛠️ Type of Change (X in brackets)

• 🐞 Bug fix – Resolves an issue without breaking functionality.
• ✨ New feature – Adds new, non-breaking functionality.
• 💥 Breaking change – Alters existing functionality in a way that may require updates.
• 🆕 New script – A fully functional and tested script or script set.
• 🌍 Website update – Changes to website-related JSON files or metadata.
• 🔧 Refactoring / Code Cleanup – Improves readability or maintainability without changing functionality.
• 📝 Documentation update – Changes to README, AppName.md, CONTRIBUTING.md, or other docs.