packaging: signed APT repository and Flatpak remote on GitHub Pages

[francescobianco]

Summary

• .github/workflows/repos.yml: runs after each successful Release (or by hand), downloads the latest .deb and .flatpak, builds both repositories, signs them and deploys them to GitHub Pages.
• build-aux/repos/build-site.sh: builds the site.
  • APT repo: stable/main for all/amd64/arm64, signed InRelease and Release.gpg, plus a deb822 gknowledge.sources.
  • Flatpak remote: imported from the release bundle, with a static delta, gknowledge.flatpakrepo and io.gknowledge.Gknowledge.flatpakref (runtime taken from Flathub).
  • Landing page index.html with the public key fingerprint.
• install.sh: on apt systems it adds the repository and installs from it, so updates come through apt upgrade. If the repository is unreachable it removes the source again and falls back to the release .deb. GKNOWLEDGE_NO_REPO=1 keeps the old behaviour.
• READMEs (EN, IT, 简体中文) and ROADMAP updated.

Setup

• Signing key: ed25519, expires in 5 years, fingerprint DC96953E166385A6606938A990FC5B455E6B8648. It is stored in the GPG_PRIVATE_KEY repository secret.
• GitHub Pages must be enabled with Source: GitHub Actions.
• After merging, run Package repositories once from the Actions tab. Later releases trigger it automatically.

Testing

Tested locally in debian:trixie against a local HTTP server, with a throwaway key and the v0.2.2 assets:

• apt update verifies the signature, and apt install gknowledge installs 0.2.2 from the repo.
• flatpak remote-add from the .flatpakrepo and flatpak remote-ls list the app. Installing from the .flatpakref with --no-deps succeeds.
• install.sh, repo reachable: adds gknowledge.sources and installs from the repo.
• install.sh, repo unreachable: warns, installs the release .deb, leaves no source behind, and apt update stays clean.

The workflow itself has not run yet. It needs Pages enabled and must run from main.

🤖 Generated with Claude Code