Wire Forge-native release infrastructure

package/repositories/README.md

@@ -0,0 +1,52 @@
+# Burrow Native Package Repositories
+
+Burrow publishes native daemon packages through repository formats that Linux
+desktops already understand:
+
+- APT repository for Debian and Ubuntu
+- RPM repository for Fedora, RHEL-family systems, and openSUSE-family systems
+- pacman repository for Arch-family systems
+- AUR source package repository for Arch users who prefer local builds
+- Flatpak repository descriptor for the GTK GUI, with the daemon still supplied
+  by a native package
+- NixOS flake/module for NixOS
+
+APT, RPM, and pacman repository metadata is signed with OpenPGP signatures
+produced by `Scripts/package/google-kms-openpgp.py`. The OpenPGP public keys are
+derived from the Google Cloud KMS public keys, while the private RSA signing
+operation happens inside Google Cloud KMS. Each repository format has its own
+KMS key:
+
+- `package-apt-repository`
+- `package-rpm-repository`
+- `package-pacman-repository`
+- `package-flatpak-repository`
+- `package-aur-source`
+
+Build repository metadata from package artifacts with:
+
+```sh
+BURROW_PACKAGE_INPUT_DIR=dist/packages \
+BURROW_APT_REPO_KMS_PUBLIC_KEY_PEM=.kms/apt.pem \
+BURROW_RPM_REPO_KMS_PUBLIC_KEY_PEM=.kms/rpm.pem \
+BURROW_PACMAN_REPO_KMS_PUBLIC_KEY_PEM=.kms/pacman.pem \
+Scripts/package/build-repositories.sh all
+```
+
+The builder writes repository trees under `publish/repositories` by default:
+
+- `apt/dists/<suite>/...`
+- `rpm/<channel>/<basearch>/...`
+- `arch/burrow/<arch>/...`
+- `keys/*.asc`
+
+The Forgejo workflow `.forgejo/workflows/publish-package-repositories.yml`
+builds Linux package artifacts, exports KMS public keys, signs repository
+metadata through Google KMS, uploads the repository tree as a workflow artifact,
+and publishes the tree to the package GCS bucket when `publish_gcs` is enabled.
+The workflow authenticates to the Burrow Google project through Authentik-backed
+Workload Identity Federation before it calls Google KMS or writes objects.
+
+PackageKit is an optional install frontend. It is not the repository format and
+it is not available everywhere. The Flatpak GUI should try PackageKit only as a
+convenience path, then degrade to native repository setup instructions.

package/repositories/apt/burrow.sources

@@ -0,0 +1,6 @@
+Types: deb
+URIs: https://packages.burrow.net/apt
+Suites: stable
+Components: main
+Architectures: amd64 arm64
+Signed-By: /usr/share/keyrings/burrow-package-apt-repository.gpg

package/repositories/flatpak/burrow.flatpakrepo.in

@@ -0,0 +1,8 @@
+[Flatpak Repo]
+Title=Burrow
+Url=https://packages.burrow.net/flatpak
+Homepage=https://burrow.net
+Comment=Burrow GTK desktop UI
+Description=Burrow GTK desktop UI. VPN operation requires the native Burrow daemon package on the host.
+Icon=https://burrow.net/icon.png
+GPGKey=@BURROW_FLATPAK_GPG_KEY_BASE64@

package/repositories/packagekit/README.md

@@ -0,0 +1,16 @@
+# PackageKit Bootstrap
+
+PackageKit is the closest cross-distro install prompt for mutable Linux
+desktops. Burrow treats it as an optional bootstrap path:
+
+```sh
+pkcon install burrow
+```
+
+This works only when the host distro has PackageKit, the Burrow native
+repository is configured, and polkit authorizes the action. The Flatpak GUI may
+offer this path through a narrow `org.freedesktop.PackageKit` permission, but it
+must also support direct native-repository instructions.
+
+The command fallback helper checks `apt-get`, `dnf`, `zypper`, `pacman`, `apk`,
+`xbps-install`, `eopkg`, `emerge`, `swupd`, and `nix` after PackageKit.

package/repositories/pacman/pacman.conf

@@ -0,0 +1,3 @@
+[burrow]
+Server = https://packages.burrow.net/arch/burrow/$arch
+SigLevel = Required DatabaseOptional

package/repositories/rpm/burrow.repo

@@ -0,0 +1,7 @@
+[burrow]
+name=Burrow
+baseurl=https://packages.burrow.net/rpm/stable/$basearch
+enabled=1
+gpgcheck=1
+repo_gpgcheck=1
+gpgkey=https://packages.burrow.net/keys/burrow-package-rpm-repository.asc