Getting a download link by hand

The Releases table has a Get link control against each published package. It gives you the same signed URL the hub hands to a site checking for updates, valid for 30 days.

Useful wherever the update channel does not reach: a UAT or staging site, a customer you are helping directly, or a build that is distributed through the WordPress directory rather than the hub and so is never offered here at all.

The same link comes back in the reply when a release is published over the API, so whatever published a build can install it without anyone opening this screen.

The link carries its own authority — no token, no login. Anyone holding it can download that package until it expires, so treat it like the file itself. It stops working on its own, which is the point of the expiry — 30 days covers a round of UAT without needing a fresh link halfway through.