Download the FOSSA CLI build matching the host architecture

[cmboling]

Download the FOSSA CLI build matching the host architecture

Branch: fix/arm64-cli-download → main
Type: Bug fix

Problem

Broker requests the amd64 FOSSA CLI asset on every platform. src/fossa_cli.rs
said so explicitly:

// We only support "amd64" right now, so no need to look at target_arch

On an ARM64 host that binary cannot run, and the failure is unusually hard to
diagnose:

• On Apple Silicon the OS terminates the process (SIGKILL, exit 137) rather than
  returning an error. Under Rosetta the GHC-built binary fails with
  __thread_starts section missing.
• Broker catches this as a generic analyze failure, so every integration reports a
  failure naming the user's repository, with a message suggesting they debug their
  own project. Nothing points at the CLI.
• find_or_download checks the local version by running the binary. That check
  fails too, so the unusable download is re-fetched on every run instead of being
  replaced.

The practical effect is that Broker does not work on a modern Mac, and the error
message sends the user to the wrong place.

Fix

Select the asset matching the host architecture. FOSSA CLI already publishes what
is needed — verified against the v3.18.2 release:

Platform	amd64	arm64
darwin	✅	✅
linux	✅	✅
windows	✅	—

Windows has no ARM64 asset and continues to use amd64, which runs under emulation
on Windows on ARM.

Tests

• download_url_targets_the_running_architecture — asserts the URL names the
  architecture Broker is running on.
• download_url_asset_exists (#[ignore]) — performs a HEAD request against the
  release to confirm the asset Broker asks for is actually published. Without this,
  a typo in an asset name would pass unit tests and fail only at runtime, in exactly
  the silent way the original bug did.

Verification

Reproduced and fixed on an Apple Silicon Mac. Deleting the cached binary and letting
Broker download it unaided:

before:  ~/.config/fossa/broker/fossa → Mach-O 64-bit executable x86_64   (exit 137)
after:   ~/.config/fossa/broker/fossa → Mach-O 64-bit executable arm64    (works)

Against a real 19-repository config:

	✅	❌
before	0 repos	22
after	19 repos	0

Same config, same credentials, same repositories — only the CLI architecture changed.

cargo fmt --check, cargo clippy --all-targets --all-features -- -D warnings, and
the test suite all pass.

Upgrade note

An existing bad binary is cached and Broker will not replace it on its own, because
the version check cannot run it. Users on ARM64 should delete it once:

rm ~/.config/fossa/broker/fossa

This is called out in the changelog.

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: Repository YAML (base), Organization UI (inherited)

Review profile: ASSERTIVE

Plan: Team

Run ID: 9260b9c5-ef0e-4c7e-945e-2b59bc136dc5

---

_{Comment @coderabbitai help to get the list of available commands.}