Wire Forge-native release infrastructure

package/arch/README.md

@@ -0,0 +1,15 @@
+# Arch and AUR
+
+Burrow has two Arch-family distribution surfaces:
+
+- `package/arch/aur/burrow-git` is the source-build AUR package repository.
+- `package/repositories/pacman/pacman.conf` describes the binary pacman
+  repository at `packages.burrow.net`.
+
+Publish `burrow-git` to the AUR as its own git repository. Regenerate
+`.SRCINFO` from the same `PKGBUILD` before pushing an AUR update.
+
+The binary pacman repository is built by
+`Scripts/package/build-repositories.sh arch` and signs both packages and the
+repository database sidecars through the `package-pacman-repository` Google KMS
+key.

package/arch/aur/burrow-git/.SRCINFO

@@ -0,0 +1,21 @@
+pkgbase = burrow-git
+	pkgdesc = Burrow VPN daemon and CLI
+	pkgver = 0.1.r0.g0000000
+	pkgrel = 1
+	url = https://git.burrow.net/hackclub/burrow
+	install = burrow.install
+	arch = x86_64
+	arch = aarch64
+	license = GPL-3.0-or-later
+	makedepends = cargo
+	makedepends = git
+	makedepends = protobuf
+	depends = openssl
+	depends = sqlite
+	depends = systemd
+	provides = burrow
+	conflicts = burrow
+	source = git+https://git.burrow.net/hackclub/burrow.git
+	sha256sums = SKIP
+
+pkgname = burrow-git

package/arch/aur/burrow-git/PKGBUILD

@@ -0,0 +1,35 @@
+# Maintainer: Burrow Release Automation <packages@burrow.net>
+
+pkgname=burrow-git
+pkgver=0.1.r0.g0000000
+pkgrel=1
+pkgdesc="Burrow VPN daemon and CLI"
+arch=("x86_64" "aarch64")
+url="https://git.burrow.net/hackclub/burrow"
+license=("GPL-3.0-or-later")
+depends=("openssl" "sqlite" "systemd")
+makedepends=("cargo" "git" "protobuf")
+provides=("burrow")
+conflicts=("burrow")
+source=("git+https://git.burrow.net/hackclub/burrow.git")
+sha256sums=("SKIP")
+install="burrow.install"
+
+pkgver() {
+  cd burrow
+  printf "0.1.r%s.g%s" "$(git rev-list --count HEAD)" "$(git rev-parse --short HEAD)"
+}
+
+build() {
+  cd burrow
+  cargo build --locked --release -p burrow --bin burrow
+}
+
+package() {
+  cd burrow
+  install -Dm755 target/release/burrow "${pkgdir}/usr/bin/burrow"
+  install -Dm644 systemd/burrow.service "${pkgdir}/usr/lib/systemd/system/burrow.service"
+  install -Dm644 systemd/burrow.socket "${pkgdir}/usr/lib/systemd/system/burrow.socket"
+  install -Dm644 README.md "${pkgdir}/usr/share/doc/burrow/README.md"
+  install -Dm644 LICENSE.md "${pkgdir}/usr/share/licenses/burrow/LICENSE.md"
+}

package/arch/aur/burrow-git/burrow.install

@@ -0,0 +1,16 @@
+post_install() {
+  systemctl daemon-reload
+  echo "Enable Burrow with: systemctl enable --now burrow.socket"
+}
+
+post_upgrade() {
+  systemctl daemon-reload
+}
+
+pre_remove() {
+  systemctl disable --now burrow.socket >/dev/null 2>&1 || true
+}
+
+post_remove() {
+  systemctl daemon-reload
+}

package/repositories/README.md

@@ -0,0 +1,52 @@
+# Burrow Native Package Repositories
+
+Burrow publishes native daemon packages through repository formats that Linux
+desktops already understand:
+
+- APT repository for Debian and Ubuntu
+- RPM repository for Fedora, RHEL-family systems, and openSUSE-family systems
+- pacman repository for Arch-family systems
+- AUR source package repository for Arch users who prefer local builds
+- Flatpak repository descriptor for the GTK GUI, with the daemon still supplied
+  by a native package
+- NixOS flake/module for NixOS
+
+APT, RPM, and pacman repository metadata is signed with OpenPGP signatures
+produced by `Scripts/package/google-kms-openpgp.py`. The OpenPGP public keys are
+derived from the Google Cloud KMS public keys, while the private RSA signing
+operation happens inside Google Cloud KMS. Each repository format has its own
+KMS key:
+
+- `package-apt-repository`
+- `package-rpm-repository`
+- `package-pacman-repository`
+- `package-flatpak-repository`
+- `package-aur-source`
+
+Build repository metadata from package artifacts with:
+
+```sh
+BURROW_PACKAGE_INPUT_DIR=dist/packages \
+BURROW_APT_REPO_KMS_PUBLIC_KEY_PEM=.kms/apt.pem \
+BURROW_RPM_REPO_KMS_PUBLIC_KEY_PEM=.kms/rpm.pem \
+BURROW_PACMAN_REPO_KMS_PUBLIC_KEY_PEM=.kms/pacman.pem \
+Scripts/package/build-repositories.sh all
+```
+
+The builder writes repository trees under `publish/repositories` by default:
+
+- `apt/dists/<suite>/...`
+- `rpm/<channel>/<basearch>/...`
+- `arch/burrow/<arch>/...`
+- `keys/*.asc`
+
+The Forgejo workflow `.forgejo/workflows/publish-package-repositories.yml`
+builds Linux package artifacts, exports KMS public keys, signs repository
+metadata through Google KMS, uploads the repository tree as a workflow artifact,
+and publishes the tree to the package GCS bucket when `publish_gcs` is enabled.
+The workflow authenticates to the Burrow Google project through Authentik-backed
+Workload Identity Federation before it calls Google KMS or writes objects.
+
+PackageKit is an optional install frontend. It is not the repository format and
+it is not available everywhere. The Flatpak GUI should try PackageKit only as a
+convenience path, then degrade to native repository setup instructions.

package/repositories/apt/burrow.sources

@@ -0,0 +1,6 @@
+Types: deb
+URIs: https://packages.burrow.net/apt
+Suites: stable
+Components: main
+Architectures: amd64 arm64
+Signed-By: /usr/share/keyrings/burrow-package-apt-repository.gpg

package/repositories/flatpak/burrow.flatpakrepo.in

@@ -0,0 +1,8 @@
+[Flatpak Repo]
+Title=Burrow
+Url=https://packages.burrow.net/flatpak
+Homepage=https://burrow.net
+Comment=Burrow GTK desktop UI
+Description=Burrow GTK desktop UI. VPN operation requires the native Burrow daemon package on the host.
+Icon=https://burrow.net/icon.png
+GPGKey=@BURROW_FLATPAK_GPG_KEY_BASE64@

package/repositories/packagekit/README.md

@@ -0,0 +1,16 @@
+# PackageKit Bootstrap
+
+PackageKit is the closest cross-distro install prompt for mutable Linux
+desktops. Burrow treats it as an optional bootstrap path:
+
+```sh
+pkcon install burrow
+```
+
+This works only when the host distro has PackageKit, the Burrow native
+repository is configured, and polkit authorizes the action. The Flatpak GUI may
+offer this path through a narrow `org.freedesktop.PackageKit` permission, but it
+must also support direct native-repository instructions.
+
+The command fallback helper checks `apt-get`, `dnf`, `zypper`, `pacman`, `apk`,
+`xbps-install`, `eopkg`, `emerge`, `swupd`, and `nix` after PackageKit.

package/repositories/pacman/pacman.conf

@@ -0,0 +1,3 @@
+[burrow]
+Server = https://packages.burrow.net/arch/burrow/$arch
+SigLevel = Required DatabaseOptional

package/repositories/rpm/burrow.repo

@@ -0,0 +1,7 @@
+[burrow]
+name=Burrow
+baseurl=https://packages.burrow.net/rpm/stable/$basearch
+enabled=1
+gpgcheck=1
+repo_gpgcheck=1
+gpgkey=https://packages.burrow.net/keys/burrow-package-rpm-repository.asc