diff --git a/go.mod b/go.mod
index 3bfb5319f8b0bda2576725f09994e3b5c1e9e3a8..03b30dcdafdbeb2bcaca7cf29f173afd0f29a5b9 100644
--- a/go.mod
+++ b/go.mod
@@ -1,3 +1,29 @@
 module git.flow3r.garden/flowe3r/api
 
 go 1.20
+
+require (
+	dario.cat/mergo v1.0.0 // indirect
+	github.com/Microsoft/go-winio v0.6.1 // indirect
+	github.com/ProtonMail/go-crypto v0.0.0-20230717121422-5aa5874ade95 // indirect
+	github.com/acomagu/bufpipe v1.0.4 // indirect
+	github.com/cloudflare/circl v1.3.3 // indirect
+	github.com/emirpasic/gods v1.18.1 // indirect
+	github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376 // indirect
+	github.com/go-git/go-billy/v5 v5.4.1 // indirect
+	github.com/go-git/go-git/v5 v5.8.1 // indirect
+	github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect
+	github.com/jbenet/go-context v0.0.0-20150711004518-d14ea06fba99 // indirect
+	github.com/kevinburke/ssh_config v1.2.0 // indirect
+	github.com/pelletier/go-toml/v2 v2.0.9 // indirect
+	github.com/pjbgf/sha1cd v0.3.0 // indirect
+	github.com/sergi/go-diff v1.1.0 // indirect
+	github.com/skeema/knownhosts v1.2.0 // indirect
+	github.com/xanzy/ssh-agent v0.3.3 // indirect
+	golang.org/x/crypto v0.11.0 // indirect
+	golang.org/x/mod v0.8.0 // indirect
+	golang.org/x/net v0.12.0 // indirect
+	golang.org/x/sys v0.10.0 // indirect
+	golang.org/x/tools v0.6.0 // indirect
+	gopkg.in/warnings.v0 v0.1.2 // indirect
+)
diff --git a/go.sum b/go.sum
new file mode 100644
index 0000000000000000000000000000000000000000..c3f7db79577bfbe36e926e995242f957eddd78f1
--- /dev/null
+++ b/go.sum
@@ -0,0 +1,122 @@
+dario.cat/mergo v1.0.0 h1:AGCNq9Evsj31mOgNPcLyXc+4PNABt905YmuqPYYpBWk=
+dario.cat/mergo v1.0.0/go.mod h1:uNxQE+84aUszobStD9th8a29P2fMDhsBdgRYvZOxGmk=
+github.com/Microsoft/go-winio v0.5.2/go.mod h1:WpS1mjBmmwHBEWmogvA2mj8546UReBk4v8QkMxJ6pZY=
+github.com/Microsoft/go-winio v0.6.1 h1:9/kr64B9VUZrLm5YYwbGtUJnMgqWVOdUAXu6Migciow=
+github.com/Microsoft/go-winio v0.6.1/go.mod h1:LRdKpFKfdobln8UmuiYcKPot9D2v6svN5+sAH+4kjUM=
+github.com/ProtonMail/go-crypto v0.0.0-20230717121422-5aa5874ade95 h1:KLq8BE0KwCL+mmXnjLWEAOYO+2l2AE4YMmqG1ZpZHBs=
+github.com/ProtonMail/go-crypto v0.0.0-20230717121422-5aa5874ade95/go.mod h1:EjAoLdwvbIOoOQr3ihjnSoLZRtE8azugULFRteWMNc0=
+github.com/acomagu/bufpipe v1.0.4 h1:e3H4WUzM3npvo5uv95QuJM3cQspFNtFBzvJ2oNjKIDQ=
+github.com/acomagu/bufpipe v1.0.4/go.mod h1:mxdxdup/WdsKVreO5GpW4+M/1CE2sMG4jeGJ2sYmHc4=
+github.com/bwesterb/go-ristretto v1.2.3/go.mod h1:fUIoIZaG73pV5biE2Blr2xEzDoMj7NFEuV9ekS419A0=
+github.com/cloudflare/circl v1.3.3 h1:fE/Qz0QdIGqeWfnwq0RE0R7MI51s0M2E4Ga9kq5AEMs=
+github.com/cloudflare/circl v1.3.3/go.mod h1:5XYMA4rFBvNIrhs50XuiBJ15vF2pZn4nnUKZrLbUZFA=
+github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
+github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/emirpasic/gods v1.18.1 h1:FXtiHYKDGKCW2KzwZKx0iC0PQmdlorYgdFG9jPXJ1Bc=
+github.com/emirpasic/gods v1.18.1/go.mod h1:8tpGGwCnJ5H4r6BWwaV6OrWmMoPhUl5jm/FMNAnJvWQ=
+github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376 h1:+zs/tPmkDkHx3U66DAb0lQFJrpS6731Oaa12ikc+DiI=
+github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376/go.mod h1:an3vInlBmSxCcxctByoQdvwPiA7DTK7jaaFDBTtu0ic=
+github.com/go-git/go-billy/v5 v5.4.1 h1:Uwp5tDRkPr+l/TnbHOQzp+tmJfLceOlbVucgpTz8ix4=
+github.com/go-git/go-billy/v5 v5.4.1/go.mod h1:vjbugF6Fz7JIflbVpl1hJsGjSHNltrSw45YK/ukIvQg=
+github.com/go-git/go-git/v5 v5.8.1 h1:Zo79E4p7TRk0xoRgMq0RShiTHGKcKI4+DI6BfJc/Q+A=
+github.com/go-git/go-git/v5 v5.8.1/go.mod h1:FHFuoD6yGz5OSKEBK+aWN9Oah0q54Jxl0abmj6GnqAo=
+github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da h1:oI5xCqsCo564l8iNU+DwB5epxmsaqB+rhGL0m5jtYqE=
+github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
+github.com/jbenet/go-context v0.0.0-20150711004518-d14ea06fba99 h1:BQSFePA1RWJOlocH6Fxy8MmwDt+yVQYULKfN0RoTN8A=
+github.com/jbenet/go-context v0.0.0-20150711004518-d14ea06fba99/go.mod h1:1lJo3i6rXxKeerYnT8Nvf0QmHCRC1n8sfWVwXF2Frvo=
+github.com/kevinburke/ssh_config v1.2.0 h1:x584FjTGwHzMwvHx18PXxbBVzfnxogHaAReU4gf13a4=
+github.com/kevinburke/ssh_config v1.2.0/go.mod h1:CT57kijsi8u/K/BOFA39wgDQJ9CxiF4nAY/ojJ6r6mM=
+github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo=
+github.com/kr/pretty v0.2.1/go.mod h1:ipq/a2n7PKx3OHsz4KJII5eveXtPO4qwEXGdVfWzfnI=
+github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
+github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
+github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
+github.com/matryer/is v1.2.0/go.mod h1:2fLPjFQM9rhQ15aVEtbuwhJinnOqrmgXPNdZsdwlWXA=
+github.com/niemeyer/pretty v0.0.0-20200227124842-a10e7caefd8e/go.mod h1:zD1mROLANZcx1PVRCS0qkT7pwLkGfwJo4zjcN/Tysno=
+github.com/pelletier/go-toml/v2 v2.0.9 h1:uH2qQXheeefCCkuBBSLi7jCiSmj3VRh2+Goq2N7Xxu0=
+github.com/pelletier/go-toml/v2 v2.0.9/go.mod h1:tJU2Z3ZkXwnxa4DPO899bsyIoywizdUvyaeZurnPPDc=
+github.com/pjbgf/sha1cd v0.3.0 h1:4D5XXmUUBUl/xQ6IjCkEAbqXskkq/4O7LmGn0AqMDs4=
+github.com/pjbgf/sha1cd v0.3.0/go.mod h1:nZ1rrWOcGJ5uZgEEVL1VUM9iRQiZvWdbZjkKyFzPPsI=
+github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
+github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
+github.com/sergi/go-diff v1.1.0 h1:we8PVUC3FE2uYfodKH/nBHMSetSfHDR6scGdBi+erh0=
+github.com/sergi/go-diff v1.1.0/go.mod h1:STckp+ISIX8hZLjrqAeVduY0gWCT9IjLuqbuNXdaHfM=
+github.com/sirupsen/logrus v1.7.0/go.mod h1:yWOB1SBYBC5VeMP7gHvWumXLIWorT60ONWic61uBYv0=
+github.com/skeema/knownhosts v1.2.0 h1:h9r9cf0+u7wSE+M183ZtMGgOJKiL96brpaz5ekfJCpM=
+github.com/skeema/knownhosts v1.2.0/go.mod h1:g4fPeYpque7P0xefxtGzV81ihjC8sX2IqpAoNkjxbMo=
+github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
+github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSSt89Yw=
+github.com/stretchr/objx v0.5.0/go.mod h1:Yh+to48EsGEfYuaHDzXPcE3xhTkx73EhmCGUpEOglKo=
+github.com/stretchr/testify v1.2.2/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
+github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4=
+github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
+github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
+github.com/stretchr/testify v1.8.4/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo=
+github.com/xanzy/ssh-agent v0.3.3 h1:+/15pJfg/RsTxqYcX6fHqOXZwwMP+2VyYWJeWM2qQFM=
+github.com/xanzy/ssh-agent v0.3.3/go.mod h1:6dzNDKs0J9rVPHPhaGCukekBHKqfl+L3KghI1Bc68Uw=
+github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
+golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
+golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
+golang.org/x/crypto v0.0.0-20220622213112-05595931fe9d/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
+golang.org/x/crypto v0.3.1-0.20221117191849-2c476679df9a/go.mod h1:hebNnKkNXi2UzZN1eVRvBB7co0a+JxK6XbPiWVs/3J4=
+golang.org/x/crypto v0.7.0/go.mod h1:pYwdfH91IfpZVANVyUOhSIPZaFoJGxTFbZhFTx+dXZU=
+golang.org/x/crypto v0.11.0 h1:6Ewdq3tDic1mg5xRO4milcWCfMVQhI4NkqWWvqejpuA=
+golang.org/x/crypto v0.11.0/go.mod h1:xgJhtzW8F9jGdVFWZESrid1U1bjeNy4zgy5cRr/CIio=
+golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
+golang.org/x/mod v0.8.0 h1:LUYupSeNrTNCGzR/hVBk2NHZO4hXcVaW1k4Qx7rjPx8=
+golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
+golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
+golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
+golang.org/x/net v0.0.0-20211112202133-69e39bad7dc2/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
+golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
+golang.org/x/net v0.2.0/go.mod h1:KqCZLdyyvdV855qA2rE3GC2aiw5xGR5TEjj8smXukLY=
+golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
+golang.org/x/net v0.8.0/go.mod h1:QVkue5JL9kW//ek3r6jTKnTFis1tRmNAW2P1shuFdJc=
+golang.org/x/net v0.12.0 h1:cfawfvKITfUsFCeJIHJrbSxpeu/E81khclypR0GVT50=
+golang.org/x/net v0.12.0/go.mod h1:zEVYFnQC7m/vmpQFELhcD1EWkZlX69l4oqgmer6hfKA=
+golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.1.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sys v0.0.0-20191026070338-33540a1f6037/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20210124154548-22da62e12c0c/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20210423082822-04245dca01da/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.2.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.3.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.10.0 h1:SqMFp9UcQJZa+pmYuAKjd9xq1f0j5rLcDIk0mj4qAsA=
+golang.org/x/sys v0.10.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
+golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
+golang.org/x/term v0.2.0/go.mod h1:TVmDHMZPmdnySmBfhjOoOdhjzdE1h4u1VwSiw2l1Nuc=
+golang.org/x/term v0.5.0/go.mod h1:jMB1sMXY+tzblOD4FWmEbocvup2/aLOaQEp7JmGp78k=
+golang.org/x/term v0.6.0/go.mod h1:m6U89DPEgQRMq3DNkDClhWw02AUbt2daBVO4cn4Hv9U=
+golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
+golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
+golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
+golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
+golang.org/x/text v0.4.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
+golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
+golang.org/x/text v0.8.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8=
+golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
+golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
+golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc=
+golang.org/x/tools v0.6.0 h1:BOw41kyTf3PuCW1pVQf8+Cyg8pMlkYB1oo9iJ6D/lKM=
+golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU=
+golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
+gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
+gopkg.in/warnings.v0 v0.1.2 h1:wFXVbFY8DY5/xOe1ECiWdKCzZlxgshcYVNkBHstARME=
+gopkg.in/warnings.v0 v0.1.2/go.mod h1:jksf8JmL6Qr/oQM2OXTHunEvvTAsrWBLb6OOjuVWRNI=
+gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
+gopkg.in/yaml.v2 v2.2.4/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
+gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
+gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
diff --git a/main.go b/main.go
index d36a96a7ad2b42f23f635bc30a48a44d615a0391..3ab761d522a6573a8d1434a6096fede430e75dc0 100644
--- a/main.go
+++ b/main.go
@@ -1,21 +1,10 @@
 package main
 
 import (
-	"archive/tar"
-	"bytes"
-	"compress/bzip2"
 	"context"
-	"encoding/json"
 	"flag"
-	"fmt"
-	"io"
 	"log"
 	"net/http"
-	"net/url"
-	"regexp"
-	"strings"
-	"sync"
-	"time"
 )
 
 var (
@@ -25,252 +14,6 @@ var (
 	flagGitlabProject string
 )
 
-type GLAssetLink struct {
-	ID      int64  `json:"id"`
-	Name    string `json:"name"`
-	TagName string `json:"tag_name"`
-	URL     string `json:"url"`
-}
-
-type GLRelease struct {
-	Name       string    `json:"name"`
-	TagName    string    `json:"tag_name"`
-	ReleasedAt time.Time `json:"released_at"`
-	Assets     struct {
-		Links []GLAssetLink `json:"links"`
-	} `json:"assets"`
-}
-
-func getReleases(ctx context.Context) ([]GLRelease, error) {
-	path := fmt.Sprintf("https://%s/api/v4/projects/%s/releases?order_by=created_at", flagGitlabHost, url.PathEscape(flagGitlabProject))
-	req, err := http.NewRequestWithContext(ctx, "GET", path, nil)
-	if err != nil {
-		return nil, fmt.Errorf("when building request: %w", err)
-	}
-	res, err := http.DefaultTransport.RoundTrip(req)
-	if err != nil {
-		return nil, fmt.Errorf("when performing request: %w", err)
-	}
-	defer res.Body.Close()
-
-	if res.StatusCode != 200 {
-		return nil, fmt.Errorf("invalid response code %d", res.StatusCode)
-	}
-
-	var releases []GLRelease
-	j := json.NewDecoder(res.Body)
-	err = j.Decode(&releases)
-	if err != nil {
-		return nil, fmt.Errorf("when performing request: %w", err)
-	}
-	return releases, nil
-}
-
-type req struct {
-	getReleases chan []GLRelease
-}
-
-type server struct {
-	reqC chan *req
-
-	cacheMu sync.RWMutex
-	cache   map[string]map[string][]byte
-}
-
-func (s *server) run(ctx context.Context) {
-	releases, err := getReleases(ctx)
-	if err != nil {
-		log.Fatalf("Initial release fetch failed: %v", err)
-	}
-
-	t := time.NewTicker(60 * time.Second)
-	for {
-		select {
-		case r := <-s.reqC:
-			if r.getReleases != nil {
-				r.getReleases <- releases
-			}
-		case <-t.C:
-			releases, err = getReleases(ctx)
-			if err != nil {
-				log.Printf("Failed to fetch releases: %v", err)
-			}
-		}
-	}
-}
-
-func (s *server) getReleases(ctx context.Context) ([]GLRelease, error) {
-	sresC := make(chan []GLRelease)
-	select {
-	case s.reqC <- &req{getReleases: sresC}:
-		releases := <-sresC
-		return releases, nil
-	case <-ctx.Done():
-		return nil, ctx.Err()
-	}
-}
-
-func (s *server) handleReleases(w http.ResponseWriter, r *http.Request) {
-	ctx := r.Context()
-	releases, err := s.getReleases(ctx)
-	if err != nil {
-		return
-	}
-
-	type partition struct {
-		Name   string `json:"name"`
-		URL    string `json:"url"`
-		Offset string `json:"offset"`
-	}
-
-	type release struct {
-		Name       string      `json:"name"`
-		Tag        string      `json:"tag"`
-		Partitions []partition `json:"partitions"`
-	}
-
-	var resp []release
-	for _, rel := range releases {
-		var partitions []partition
-		offsets := map[string]int64{
-			"bootloader":      0,
-			"partition-table": 0x8000,
-			"recovery":        0x10000,
-			"flow3r":          0x90000,
-		}
-		for _, pname := range []string{"bootloader", "partition-table", "recovery", "flow3r"} {
-			partitions = append(partitions, partition{
-				Name:   pname,
-				URL:    fmt.Sprintf("%srelease/%s/%s.bin", flagBaseURL, rel.TagName, pname),
-				Offset: fmt.Sprintf("0x%x", offsets[pname]),
-			})
-		}
-		resp = append(resp, release{
-			Name:       rel.Name,
-			Tag:        rel.TagName,
-			Partitions: partitions,
-		})
-	}
-	w.Header().Add("Content-Type", "application/json")
-	j := json.NewEncoder(w)
-	j.Encode(resp)
-}
-
-var (
-	reMirrorURL = regexp.MustCompile("^/api/release/([^/]+)/([^/]+.bin)$")
-)
-
-func (s *server) cacheTarball(rel *GLRelease, data io.Reader) error {
-	bz2 := bzip2.NewReader(data)
-	t := tar.NewReader(bz2)
-
-	log.Printf("Extracting %q...", rel.TagName)
-	cacheEntry := make(map[string][]byte)
-	for {
-		hdr, err := t.Next()
-		if err == io.EOF {
-			break
-		}
-		if err != nil {
-			return fmt.Errorf("when reading header: %v", err)
-		}
-		parts := strings.Split(hdr.Name, "/")
-		last := parts[len(parts)-1]
-		log.Printf("%q has %q", rel.TagName, last)
-		buf := bytes.NewBuffer(nil)
-		if _, err := io.Copy(buf, t); err != nil {
-			return fmt.Errorf("file %s: %v", hdr.Name, err)
-		}
-		cacheEntry[last] = buf.Bytes()
-	}
-	s.cacheMu.Lock()
-	s.cache[rel.TagName] = cacheEntry
-	s.cacheMu.Unlock()
-	return nil
-}
-
-func (s *server) serveMirroredFile(w http.ResponseWriter, r *http.Request, rel *GLRelease, artifact string) {
-	ctx := r.Context()
-
-	s.cacheMu.RLock()
-	if s.cache[rel.TagName] != nil && s.cache[rel.TagName][artifact] != nil {
-		b := s.cache[rel.TagName][artifact]
-		s.cacheMu.RUnlock()
-		w.Header().Add("Content-Type", "application/octet-stream")
-		w.Write(b)
-		return
-	}
-	if s.cache[rel.TagName] != nil {
-		log.Printf("Failed: no %q in %q", artifact, rel.TagName)
-		http.NotFound(w, r)
-		return
-	}
-	s.cacheMu.RUnlock()
-
-	log.Printf("Fetching %q (for %q)...", rel.TagName, artifact)
-
-	if len(rel.Assets.Links) != 1 {
-		log.Printf("Tag %s has %d assets", rel.TagName, len(rel.Assets.Links))
-		http.NotFound(w, r)
-		return
-	}
-	link := rel.Assets.Links[0]
-	req, err := http.NewRequestWithContext(ctx, "GET", link.URL, nil)
-	if err != nil {
-		w.WriteHeader(500)
-		fmt.Fprintf(w, "could not download")
-		return
-	}
-	res, err := http.DefaultTransport.RoundTrip(req)
-	if err != nil {
-		w.WriteHeader(500)
-		fmt.Fprintf(w, "could not download")
-		return
-	}
-	defer res.Body.Close()
-
-	if err := s.cacheTarball(rel, res.Body); err != nil {
-		w.WriteHeader(500)
-		fmt.Fprintf(w, "could not cache")
-		return
-	}
-
-	s.cacheMu.RLock()
-	if s.cache[rel.TagName] != nil && s.cache[rel.TagName][artifact] != nil {
-		b := s.cache[rel.TagName][artifact]
-		s.cacheMu.RUnlock()
-		w.Header().Add("Content-Type", "application/octet-stream")
-		w.Write(b)
-		return
-	}
-	s.cacheMu.RUnlock()
-	http.NotFound(w, r)
-}
-
-func (s *server) handleReleaseMirror(w http.ResponseWriter, r *http.Request) {
-	ctx := r.Context()
-
-	matches := reMirrorURL.FindStringSubmatch(r.URL.Path)
-	if matches == nil {
-		http.NotFound(w, r)
-		return
-	}
-	tag := matches[1]
-	artifact := matches[2]
-
-	releases, err := s.getReleases(ctx)
-	if err != nil {
-		return
-	}
-
-	for _, rel := range releases {
-		if rel.TagName == tag {
-			s.serveMirroredFile(w, r, &rel, artifact)
-			return
-		}
-	}
-}
-
 func main() {
 	flag.StringVar(&flagBaseURL, "base_url", "https://flow3r.garden/api/", "Base address at which this instance runs (used for calculating proxied data URLs)")
 	flag.StringVar(&flagListen, "listen", ":8080", "Address on which to listen")
@@ -285,6 +28,7 @@ func main() {
 	}
 	go s.run(ctx)
 
+	http.HandleFunc("/api/apps.json", s.handleApps)
 	http.HandleFunc("/api/releases.json", s.handleReleases)
 	http.HandleFunc("/api/release/", s.handleReleaseMirror)
 	log.Printf("Listening on %s...", flagListen)
diff --git a/server.go b/server.go
new file mode 100644
index 0000000000000000000000000000000000000000..6eb3daca0f6baa296443ab01a4677c38b32e4808
--- /dev/null
+++ b/server.go
@@ -0,0 +1,81 @@
+package main
+
+import (
+	"context"
+	"log"
+	"sync"
+	"time"
+
+	"github.com/go-git/go-git/v5"
+)
+
+type server struct {
+	reqC chan *req
+
+	cacheMu sync.RWMutex
+	cache   map[string]map[string][]byte
+
+	gitMu     sync.Mutex
+	appRepo   *git.Repository
+	lastFetch time.Time
+}
+
+type req struct {
+	getReleases    chan []GLRelease
+	getAppRegistry chan []*appDescriptor
+}
+
+func (s *server) run(ctx context.Context) {
+	releases, err := getReleases(ctx)
+	if err != nil {
+		log.Fatalf("Initial release fetch failed: %v", err)
+	}
+	appRegistry, err := s.getAppRegistry(ctx)
+	if err != nil {
+		log.Fatalf("Initial app fetch failed: %v", err)
+	}
+
+	t := time.NewTicker(60 * time.Second)
+	for {
+		select {
+		case r := <-s.reqC:
+			if r.getReleases != nil {
+				r.getReleases <- releases
+			}
+			if r.getAppRegistry != nil {
+				r.getAppRegistry <- appRegistry
+			}
+		case <-t.C:
+			releases, err = getReleases(ctx)
+			if err != nil {
+				log.Printf("Failed to fetch releases: %v", err)
+			}
+			appRegistry, err = s.getAppRegistry(ctx)
+			if err != nil {
+				log.Printf("Failed to fetch app registry: %v", err)
+			}
+		}
+	}
+}
+
+func (s *server) getReleases(ctx context.Context) ([]GLRelease, error) {
+	sresC := make(chan []GLRelease)
+	select {
+	case s.reqC <- &req{getReleases: sresC}:
+		releases := <-sresC
+		return releases, nil
+	case <-ctx.Done():
+		return nil, ctx.Err()
+	}
+}
+
+func (s *server) getApps(ctx context.Context) ([]*appDescriptor, error) {
+	sresC := make(chan []*appDescriptor)
+	select {
+	case s.reqC <- &req{getAppRegistry: sresC}:
+		res := <-sresC
+		return res, nil
+	case <-ctx.Done():
+		return nil, ctx.Err()
+	}
+}
diff --git a/server_apps.go b/server_apps.go
new file mode 100644
index 0000000000000000000000000000000000000000..b9ea721d6d2a1bf01ae4549c9b8fc4f2a73f2257
--- /dev/null
+++ b/server_apps.go
@@ -0,0 +1,267 @@
+package main
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"io"
+	"log"
+	"net/http"
+	"regexp"
+	"time"
+
+	"github.com/go-git/go-git/v5"
+	"github.com/go-git/go-git/v5/config"
+	"github.com/go-git/go-git/v5/plumbing"
+	"github.com/go-git/go-git/v5/storage/memory"
+	"github.com/pelletier/go-toml/v2"
+)
+
+type appDescriptor struct {
+	repository string
+	appInfo    *appInfo
+}
+
+type appInfo struct {
+	name        string
+	menu        string
+	author      string
+	description string
+	version     int
+}
+
+var (
+	reAppPath = regexp.MustCompile(`^apps/([^/]+.toml)$`)
+	reAppRepo = regexp.MustCompile(`^([a-zA-Z\-_\.0-9]+)/([a-zA-Z\-_0-9]+)$`)
+)
+
+func (s *server) getAppInfo(ctx context.Context, repo string) (*appInfo, error) {
+	url := "https://git.flow3r.garden/" + repo
+	g, err := git.Clone(memory.NewStorage(), nil, &git.CloneOptions{
+		URL: url,
+	})
+	if err != nil {
+		return nil, fmt.Errorf("when cloning: %w", err)
+	}
+
+	cfg, err := g.Config()
+	if err != nil {
+		return nil, fmt.Errorf("when getting config: %w", err)
+	}
+	if len(cfg.Branches) < 1 {
+		return nil, fmt.Errorf("no branches")
+	}
+	var bname string
+	for name, _ := range cfg.Branches {
+		bname = name
+		break
+	}
+	bname = "main"
+	h, err := g.ResolveRevision(plumbing.Revision(bname))
+	if err != nil {
+		return nil, fmt.Errorf("resolving revision failed: %w", err)
+	}
+	err = g.Fetch(&git.FetchOptions{
+		RefSpecs: []config.RefSpec{
+			config.RefSpec(fmt.Sprintf("%s:refs/heads/%s", bname, bname)),
+		},
+	})
+	if err != nil && err != git.NoErrAlreadyUpToDate {
+		return nil, fmt.Errorf("fetch failed: %w", err)
+	}
+	obj, err := g.CommitObject(*h)
+	if err != nil {
+		return nil, fmt.Errorf("CommitObject(%v): %w", h, err)
+	}
+	f, err := obj.File("flow3r.toml")
+	if err != nil {
+		return nil, fmt.Errorf("toml open failed: %w", err)
+	}
+	reader, err := f.Reader()
+	if err != nil {
+		return nil, fmt.Errorf("f.Reader: %w", err)
+	}
+	defer reader.Close()
+	var data struct {
+		App struct {
+			Name string
+			Menu string
+		}
+		Entry struct {
+			Class string
+		}
+		Metadata struct {
+			Author      string
+			License     string
+			URL         string
+			Description string
+			Version     int
+		}
+	}
+	dec := toml.NewDecoder(reader)
+	err = dec.Decode(&data)
+	if err != nil {
+		return nil, fmt.Errorf("toml decode failed: %w", err)
+	}
+	if data.App.Name == "" || len(data.App.Name) > 32 {
+		return nil, fmt.Errorf("app name invalif")
+	}
+	sections := map[string]bool{
+		"Badge": true,
+		"Apps":  true,
+		"Music": true,
+	}
+	if !sections[data.App.Menu] {
+		return nil, fmt.Errorf("app menu invalid")
+	}
+	if data.Entry.Class == "" {
+		return nil, fmt.Errorf("no entry class")
+	}
+	if len(data.Metadata.Author) > 32 {
+		return nil, fmt.Errorf("metadata author too long")
+	}
+	if len(data.Metadata.Description) > 140 {
+		return nil, fmt.Errorf("metadata description too long")
+	}
+	return &appInfo{
+		name:        data.App.Name,
+		author:      data.Metadata.Author,
+		menu:        data.App.Menu,
+		description: data.Metadata.Description,
+		version:     data.Metadata.Version,
+	}, nil
+}
+
+func (s *server) getAppRegistry(ctx context.Context) ([]*appDescriptor, error) {
+	s.gitMu.Lock()
+	if s.appRepo == nil {
+		git, err := git.Clone(memory.NewStorage(), nil, &git.CloneOptions{
+			URL: "https://git.flow3r.garden/flow3r/flow3r-apps",
+		})
+		if err != nil {
+			return nil, err
+		}
+		s.appRepo = git
+	}
+
+	if time.Since(s.lastFetch) > 10*time.Second {
+		s.appRepo.Fetch(&git.FetchOptions{
+			RefSpecs: []config.RefSpec{
+				config.RefSpec("+refs/heads/*:refs/heads/*"),
+			},
+			Force: true,
+		})
+	}
+
+	h, err := s.appRepo.ResolveRevision(plumbing.Revision("main"))
+	if err != nil {
+		return nil, err
+	}
+	obj, err := s.appRepo.CommitObject(*h)
+	if err != nil {
+		return nil, err
+	}
+	iter, err := obj.Files()
+	if err != nil {
+		return nil, err
+	}
+
+	var res []*appDescriptor
+	for {
+		f, err := iter.Next()
+		if err == io.EOF {
+			break
+		}
+		if err != nil {
+			return nil, err
+		}
+		if !f.Mode.IsFile() {
+			continue
+		}
+		m := reAppPath.FindStringSubmatch(f.Name)
+		if m == nil {
+			continue
+		}
+		reader, err := f.Reader()
+		if err != nil {
+			log.Printf("App %q: couldn't read TOML: %v", m[1], err)
+			continue
+		}
+
+		dec := toml.NewDecoder(reader)
+		var dat struct {
+			Repo string
+		}
+		err = dec.Decode(&dat)
+		reader.Close()
+		if err != nil {
+			log.Printf("App %q: couldn't parse TOML: %v", m[1], err)
+			continue
+		}
+		n := reAppRepo.FindStringSubmatch(dat.Repo)
+		if n == nil {
+			log.Printf("App %q: invalid repo %q", m[1], dat.Repo)
+			continue
+		}
+		res = append(res, &appDescriptor{
+			repository: dat.Repo,
+		})
+	}
+
+	for _, app := range res {
+		info, err := s.getAppInfo(ctx, app.repository)
+		if err != nil {
+			log.Printf("App %q: %v", app.repository, err)
+			continue
+		} else {
+			log.Printf("App: %q: okay", app.repository)
+		}
+		app.appInfo = info
+		log.Printf("%+v", app.appInfo)
+	}
+
+	log.Printf("Got %d apps", len(res))
+	return res, nil
+}
+
+func (s *server) handleApps(w http.ResponseWriter, r *http.Request) {
+	ctx := r.Context()
+	apps, err := s.getApps(ctx)
+	if err != nil {
+		return
+	}
+
+	type app struct {
+		RepoURL     string `json:"repoURL"`
+		Name        string `json:"name"`
+		Menu        string `json:"menu"`
+		Author      string `json:"author"`
+		Description string `json:"description"`
+		Version     int    `json:"version"`
+	}
+
+	type res struct {
+		DT   time.Time `json:"isodatetime"`
+		Apps []app     `json:"apps"`
+	}
+
+	resp := res{
+		DT: time.Now(),
+	}
+	for _, a := range apps {
+		if a.appInfo == nil {
+			continue
+		}
+		resp.Apps = append(resp.Apps, app{
+			RepoURL:     "https://git.flow3r.garden/" + a.repository,
+			Name:        a.appInfo.name,
+			Menu:        a.appInfo.menu,
+			Author:      a.appInfo.author,
+			Description: a.appInfo.description,
+			Version:     a.appInfo.version,
+		})
+	}
+	w.Header().Add("Content-Type", "application/json")
+	j := json.NewEncoder(w)
+	j.Encode(resp)
+}
diff --git a/server_mirror.go b/server_mirror.go
new file mode 100644
index 0000000000000000000000000000000000000000..9aff64c9e6ba97bbd285d4fe74caf5bfa0f4e675
--- /dev/null
+++ b/server_mirror.go
@@ -0,0 +1,123 @@
+package main
+
+import (
+	"archive/tar"
+	"bytes"
+	"compress/bzip2"
+	"fmt"
+	"io"
+	"log"
+	"net/http"
+	"strings"
+)
+
+func (s *server) cacheTarball(rel *GLRelease, data io.Reader) error {
+	bz2 := bzip2.NewReader(data)
+	t := tar.NewReader(bz2)
+
+	log.Printf("Extracting %q...", rel.TagName)
+	cacheEntry := make(map[string][]byte)
+	for {
+		hdr, err := t.Next()
+		if err == io.EOF {
+			break
+		}
+		if err != nil {
+			return fmt.Errorf("when reading header: %v", err)
+		}
+		parts := strings.Split(hdr.Name, "/")
+		last := parts[len(parts)-1]
+		log.Printf("%q has %q", rel.TagName, last)
+		buf := bytes.NewBuffer(nil)
+		if _, err := io.Copy(buf, t); err != nil {
+			return fmt.Errorf("file %s: %v", hdr.Name, err)
+		}
+		cacheEntry[last] = buf.Bytes()
+	}
+	s.cacheMu.Lock()
+	s.cache[rel.TagName] = cacheEntry
+	s.cacheMu.Unlock()
+	return nil
+}
+
+func (s *server) serveMirroredFile(w http.ResponseWriter, r *http.Request, rel *GLRelease, artifact string) {
+	ctx := r.Context()
+
+	s.cacheMu.RLock()
+	if s.cache[rel.TagName] != nil && s.cache[rel.TagName][artifact] != nil {
+		b := s.cache[rel.TagName][artifact]
+		s.cacheMu.RUnlock()
+		w.Header().Add("Content-Type", "application/octet-stream")
+		w.Write(b)
+		return
+	}
+	if s.cache[rel.TagName] != nil {
+		log.Printf("Failed: no %q in %q", artifact, rel.TagName)
+		http.NotFound(w, r)
+		return
+	}
+	s.cacheMu.RUnlock()
+
+	log.Printf("Fetching %q (for %q)...", rel.TagName, artifact)
+
+	if len(rel.Assets.Links) != 1 {
+		log.Printf("Tag %s has %d assets", rel.TagName, len(rel.Assets.Links))
+		http.NotFound(w, r)
+		return
+	}
+	link := rel.Assets.Links[0]
+	req, err := http.NewRequestWithContext(ctx, "GET", link.URL, nil)
+	if err != nil {
+		w.WriteHeader(500)
+		fmt.Fprintf(w, "could not download")
+		return
+	}
+	res, err := http.DefaultTransport.RoundTrip(req)
+	if err != nil {
+		w.WriteHeader(500)
+		fmt.Fprintf(w, "could not download")
+		return
+	}
+	defer res.Body.Close()
+
+	if err := s.cacheTarball(rel, res.Body); err != nil {
+		w.WriteHeader(500)
+		fmt.Fprintf(w, "could not cache")
+		return
+	}
+
+	s.cacheMu.RLock()
+	if s.cache[rel.TagName] != nil && s.cache[rel.TagName][artifact] != nil {
+		b := s.cache[rel.TagName][artifact]
+		s.cacheMu.RUnlock()
+		w.Header().Add("Content-Type", "application/octet-stream")
+		w.Write(b)
+		return
+	}
+	s.cacheMu.RUnlock()
+	http.NotFound(w, r)
+}
+
+func (s *server) handleReleaseMirror(w http.ResponseWriter, r *http.Request) {
+	ctx := r.Context()
+
+	matches := reMirrorURL.FindStringSubmatch(r.URL.Path)
+	if matches == nil {
+		http.NotFound(w, r)
+		return
+	}
+	tag := matches[1]
+	artifact := matches[2]
+
+	releases, err := s.getReleases(ctx)
+	if err != nil {
+		return
+	}
+
+	for _, rel := range releases {
+		if rel.TagName == tag {
+			s.serveMirroredFile(w, r, &rel, artifact)
+			return
+		}
+	}
+}
diff --git a/server_releases.go b/server_releases.go
new file mode 100644
index 0000000000000000000000000000000000000000..6919d24fc18437414f2e872d619254faef4b3126
--- /dev/null
+++ b/server_releases.go
@@ -0,0 +1,102 @@
+package main
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"net/url"
+	"regexp"
+	"time"
+)
+
+var (
+	reMirrorURL = regexp.MustCompile("^/api/release/([^/]+)/([^/]+.bin)$")
+)
+
+type GLAssetLink struct {
+	ID      int64  `json:"id"`
+	Name    string `json:"name"`
+	TagName string `json:"tag_name"`
+	URL     string `json:"url"`
+}
+
+type GLRelease struct {
+	Name       string    `json:"name"`
+	TagName    string    `json:"tag_name"`
+	ReleasedAt time.Time `json:"released_at"`
+	Assets     struct {
+		Links []GLAssetLink `json:"links"`
+	} `json:"assets"`
+}
+
+func getReleases(ctx context.Context) ([]GLRelease, error) {
+	path := fmt.Sprintf("https://%s/api/v4/projects/%s/releases?order_by=created_at", flagGitlabHost, url.PathEscape(flagGitlabProject))
+	req, err := http.NewRequestWithContext(ctx, "GET", path, nil)
+	if err != nil {
+		return nil, fmt.Errorf("when building request: %w", err)
+	}
+	res, err := http.DefaultTransport.RoundTrip(req)
+	if err != nil {
+		return nil, fmt.Errorf("when performing request: %w", err)
+	}
+	defer res.Body.Close()
+
+	if res.StatusCode != 200 {
+		return nil, fmt.Errorf("invalid response code %d", res.StatusCode)
+	}
+
+	var releases []GLRelease
+	j := json.NewDecoder(res.Body)
+	err = j.Decode(&releases)
+	if err != nil {
+		return nil, fmt.Errorf("when performing request: %w", err)
+	}
+	return releases, nil
+}
+
+func (s *server) handleReleases(w http.ResponseWriter, r *http.Request) {
+	ctx := r.Context()
+	releases, err := s.getReleases(ctx)
+	if err != nil {
+		return
+	}
+
+	type partition struct {
+		Name   string `json:"name"`
+		URL    string `json:"url"`
+		Offset string `json:"offset"`
+	}
+
+	type release struct {
+		Name       string      `json:"name"`
+		Tag        string      `json:"tag"`
+		Partitions []partition `json:"partitions"`
+	}
+
+	var resp []release
+	for _, rel := range releases {
+		var partitions []partition
+		offsets := map[string]int64{
+			"bootloader":      0,
+			"partition-table": 0x8000,
+			"recovery":        0x10000,
+			"flow3r":          0x90000,
+		}
+		for _, pname := range []string{"bootloader", "partition-table", "recovery", "flow3r"} {
+			partitions = append(partitions, partition{
+				Name:   pname,
+				URL:    fmt.Sprintf("%srelease/%s/%s.bin", flagBaseURL, rel.TagName, pname),
+				Offset: fmt.Sprintf("0x%x", offsets[pname]),
+			})
+		}
+		resp = append(resp, release{
+			Name:       rel.Name,
+			Tag:        rel.TagName,
+			Partitions: partitions,
+		})
+	}
+	w.Header().Add("Content-Type", "application/json")
+	j := json.NewEncoder(w)
+	j.Encode(resp)
+}