packages.arasaka.software is published from its own repository; the release only signs the rpm

thepra/packages.arasaka.software now reads this repository's releases and publishes
them with every other joined app, so the daily packages and F-Droid jobs, their
scripts and the repository's F-Droid settings leave this repository. The release
still signs the rpm on its own page with the Arasaka key, as the README promises,
and the F-Droid listing stays in packaging/fdroid/metadata, read at each tag.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

CLAUDE.md

@@ -44,9 +44,8 @@ is root-owned, so CI uses the runner user's own `~/.dotnet` (passolo's `tools/re
 | `MEWEB_KEYSTORE` | release step | a temporary file in `$RUNNER_TEMP` decoded by `.gitea/scripts/android.sh`, removed on exit |
 
 `build.yml` runs on every push to `master`; `release.yml` on a `v*` tag (publishes the Gitea release) or by hand
-(`publish: false` builds every platform and deploys the server only); `fdroid.yml` daily at 05:23 UTC or by hand
-(the F-Droid tools, below); `packages.yml` daily at 05:43 UTC or by hand (the deb and rpm tools, below). All four
-run on the Arasaka org runner `nuvola`,
+(`publish: false` builds every platform and deploys the server only). Both run on `nuvola`, the instance-wide runner
+on the box (since 1 Nov 2026 it also takes the jobs labelled `build`),
 user `gitea-runner`, home `/var/lib/gitea-runner`: `tools/sdk.sh` installs the SDK from `global.json` into its
 `~/.dotnet` (the system SDK in `/opt/dotnet` is older and root-owned), and the JDK, nfpm and the Android SDK are
 cached in `~/.cache/meweb`. There is deliberately no `pull_request` trigger: the runner is the production box.
@@ -161,58 +160,26 @@ The Android release key: alias `meweb`, certificate SHA-256
   the network and the block without the publisher's server. A change to any knowledge file's format bumps
   `KnowledgeFeeder.Format` and the `"format":N` that `wait-knowledge.sh` waits for: the feeder rebuilds only when a
   source changes or the format differs, and a release must not embed the previous build.
-- **The deb and rpm reach packages.arasaka.software from this repository's own release job.** On tags,
-  `.gitea/scripts/packages.sh` runs on the `nuvola` runner (host mode, user `gitea-runner`, which owns
-  `/var/www/packages.arasaka.software`). It imports the org secret `PACKAGES_SIGNING_KEY` into a throwaway
-  `GNUPGHOME`, refuses any key but `F92C166E…3FB2`, signs the rpm in place, hard-links the current pool into a new
-  `.snap/` folder, adds this version, keeps the newest five, rebuilds and signs the apt (`InRelease`, `Release.gpg`)
-  and rpm (`repomd.xml.asc`) metadata, carries over the files the previous `repomd.xml` named so a client mid-refresh
-  still finds them, swaps the `apt` and `rpm` links, rewrites `SHA256SUMS.txt` for the signed rpm, and checks the live
-  site. Never copy a package over a pool file: the pools are hard links into older snapshots, so it is `rm` then `cp`.
-  `PACKAGES_ROOT` and `PACKAGES_KEEP` exist for a test against a copy. YoloCICD, which used to do this, was erased on
-  23 Oct 2026. `packaging/arasaka-repository.sh` is written into both maintainer scripts by `tools/release.cs`; it is
-  now maintained here by hand, and any change to a file it writes needs the old content's SHA-256 kept in
-  `arasaka_repository_known`, or installed copies are treated as edited by hand and left alone. The package owns
-  `/usr/share/arasaka-repository/meweb`, the marker that keeps the repository configured while any Arasaka package
-  is installed. The signing key's only copies are that secret and the owner's Nextcloud backup.
-  **The tools that build these two repositories are the box's own Ubuntu packages** (`apt-utils` for
-  `apt-ftparchive`, `createrepo-c`, `dpkg`, `gnupg`, `rpm`), and **a daily job keeps them current** (owner, 31 Oct
-  2026: the same daily update as the F-Droid tools). The runner cannot install packages, so the update is a root
-  timer on the box, `packages-tools.timer` at 05:13 UTC (source and setup in arasaka.software,
-  `deploy/packages.arasaka.software/`). It upgrades only those packages, from Ubuntu's updates and security
-  fixes, with package lists of its own, so it never brings the rest of the box forward. There is no two-week wait,
-  as there is for fdroidserver: Ubuntu reviews and signs these updates itself. `packages.yml` follows at 05:43 UTC. It fails if
-  the morning's update failed (it reads the result with `systemctl show`, which needs no rights), then runs this
-  script with no version. When the tools' versions or this script differ from what the live repositories were built
-  from (`built-from` beside each snapshot), it rebuilds and re-signs both from the current pools with no new package,
-  swaps the links and checks the live site; otherwise it says "nothing new" and names the versions. Unlike
-  fdroidserver, these tools cannot be kept beside an older copy, so a release uses whatever is installed; an update
-  that breaks them fails the next morning's job first.
-- **The APK reaches an F-Droid repository on packages.arasaka.software from the same job** (31 Oct 2026), after the
-  release is published, so the repository can lag the release page but never lead it. `.gitea/scripts/fdroid.sh`
-  installs fdroidserver with uv from `setup.json` (its download cache in `tools/fdroid`, cached like the JDK), because
-  the box has no `ensurepip` and the apt package would bring 242 others. **Nothing pins fdroidserver; a daily job
-  keeps it current** (owner, 31 Oct 2026: a daily service, not patching it from time to time). `fdroid.yml` runs the
-  same script with no version at 05:23 UTC: it resolves the newest fdroidserver, and the newest of everything it
-  needs, published at least 14 days earlier (a bad upload has usually been pulled by then), against the box's own
-  `python3`, into a hash-locked list; a new list gets its own install, `fdroidserver-<hash of the list>` in the cache's
-  real path (an install's scripts carry the absolute path they were made at; 0.15.1 failed with `fdroid: not found` on
-  one made from a deleted folder). When that list or the listing in `packaging/fdroid/` differs from what the live
-  repository was built from (`built-from` beside each snapshot), it rebuilds the repository with it, and only once
-  that is live and verified does the install become `current` and the older ones go. A release uses `current` and
-  downloads nothing, so a new fdroidserver that breaks fails the daily job, never a release; the job's log names the
-  version. Every install runs with the signing key out of its environment.
-  It signs the repository with the APK's own key (`MEWEB_KEYSTORE_B64` and `MEWEB_KEYSTORE_PASS`, alias `meweb`), so
-  the F-Droid fingerprint is the certificate's `5F52CFF4…FDF846` and there is no second key to lose; it refuses any
-  other. It builds a new snapshot in
-  `/var/www/packages.arasaka.software/.fdroid/` from the live one (the APKs as hard links, so `rm` then `cp` as above;
-  the metadata, the icons, `apkcache.json` and the previous `index-v2.json`, which is where fdroidserver reads each
-  APK's first date; without the icons a rebuild with no new APK fails, because the cache skips extracting them), adds
-  this version (a release) or nothing (the daily job), keeps the newest three, runs `fdroid update`, deletes `repo/status/` (it names the
-  build machine's paths and `/etc/issue.net`), swaps the `fdroid/repo` link and checks the live signature. The key
-  was already never to be regenerated; now everyone who added the repository trusts only its fingerprint too. `packaging/fdroid/` holds the
-  repository's settings, its icon (the Arasaka emblem) and the app's listing in English and Italian; the download
-  page links to it and to Obtainium (`Endpoints.FDroid`, source `FDroidRepo`).
+- **packages.arasaka.software is fed from outside this repository** (since 1 Nov 2026). The private repository
+  `thepra/packages.arasaka.software` lists this app in `apps/meweb.yml`, reads every `v*` release from the Releases
+  tab every 15 minutes, and publishes the newest five debs and rpms, the newest three APKs in the F-Droid repository
+  and the newest Windows and macOS files under `/download/meweb/`, all signed with keys that live as `thepra`'s own
+  secrets. Its README is the reference. What this repository still owes it:
+  - **The release must carry every file named in that entry and list each in `SHA256SUMS.txt`**, or the publisher
+    leaves the version out and keeps serving the previous one. Renaming a release file means changing `apps/meweb.yml`
+    in the same hour.
+  - **The rpm is signed here, before the release is published**, by `.gitea/scripts/sign-rpm.sh` with the Arasaka org
+    secret `PACKAGES_SIGNING_KEY` (it refuses any key but `F92C166E…3FB2`), which then rewrites `SHA256SUMS.txt`, so
+    the README's promise holds for the file on the release page too; the publisher sees the signature and keeps it.
+  - **The F-Droid listing stays in `packaging/fdroid/metadata/`** (English and Italian); the publisher reads it at the
+    release's tag. The repository's own settings and icon moved there.
+  - **The APK's signing key also signs the F-Droid index**, so `MEWEB_KEYSTORE_B64` exists twice: here, to sign the
+    APK, and as `thepra`'s `FDROID_KEYSTORE_B64`. The publisher refuses an APK signed by anything but `5f52cff4…f846`.
+  - `packaging/arasaka-repository.sh` is written into both maintainer scripts by `tools/release.cs`; it is
+    maintained here by hand, and any change to a file it writes needs the old content's SHA-256 kept in
+    `arasaka_repository_known`, or installed copies are treated as edited by hand and left alone. The package owns
+    `/usr/share/arasaka-repository/meweb`, the marker that keeps the repository configured while any Arasaka package
+    is installed. The portal app (`arasaka.software`, `arasaka-portal`) carries a byte-identical copy; change both.
 - **The server cannot ping**: `NoNewPrivileges` drops `ping`'s file capability and `ping_group_range` is closed, so
   the trace back to a caller uses `tracepath` (UDP, unprivileged) and keeps only public hops outside `Probe:Refuse`,
   so the box's own network never reaches an app.