packages.arasaka.software is published from its own repository; the release only signs the rpm

thepra/packages.arasaka.software now reads this repository's releases and publishes
them with every other joined app, so the daily packages and F-Droid jobs, their
scripts and the repository's F-Droid settings leave this repository. The release
still signs the rpm on its own page with the Arasaka key, as the README promises,
and the F-Droid listing stays in packaging/fdroid/metadata, read at each tag.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

.gitea/scripts/sign-rpm.sh

@@ -0,0 +1,19 @@
+#!/bin/sh
+set -eu
+version=$1
+releases=$(pwd)/releases/$version
+rpm=$releases/MeWeb-$version-linux-x64.rpm
+fingerprint=F92C166E9B1C13EDD1629E76888DCF969D133FB2
+test -f "$rpm"
+keys=$(mktemp -d)
+trap 'rm -rf "$keys"' EXIT
+export GNUPGHOME="$keys"
+printf '%s\n' "$PACKAGES_SIGNING_KEY" | gpg --batch --quiet --import
+gpg --batch --with-colons --list-secret-keys | grep -q "^fpr:::::::::$fingerprint:$"
+gpg --batch --armor --export "$fingerprint" > "$keys/public.asc"
+rpmsign --define "__gpg /usr/bin/gpg" --define "_gpg_name $fingerprint" --define "_gpg_path $keys" --addsign "$rpm" > /dev/null
+rpmkeys --dbpath "$keys/rpmdb" --import "$keys/public.asc"
+rpmkeys --dbpath "$keys/rpmdb" -K "$rpm" | grep -q 'digests signatures OK'
+(cd "$releases" && for file in $(ls | LC_ALL=C sort); do [ "$file" = SHA256SUMS.txt ] || sha256sum "$file"; done) > "$keys/sums"
+mv "$keys/sums" "$releases/SHA256SUMS.txt"
+echo "signed $(basename "$rpm") with $fingerprint"