with a private repo and this cgi setup:

#!/usr/bin/env fossil
repolist
directory: /var/www/repo
notfound: /repo/

the following message shows up when one navigates to the /download page:

Bummer. You do not have permission to download. Maybe it would work better if you logged in.

The BUG is that clicking on the logged in link takes you to /repo/login when it should be taking you /repo/project/login if you start from /repo/project/download

Perhaps there's a bug somewhere around src/clone.c when the cgi does repolist handling??

The [LOGIN] button in the top right does have the correct login link on the same page, BTW.