package updates: Forgejo apk registry publishing + repo-config aport

CI publishes every locally built apk to the instance's Alpine registry
(catbot credentials via the PACKAGE_TOKEN secret; step skips until it
exists). catcrafts-fp6-repo ships the registry signing key and appends
the repo URL - NOT yet in extra_packages: the registry must have its
first content before image builds may reference it (an empty repo's
missing APKINDEX would break apk in the build chroots).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

.forgejo/workflows/build.yml

@@ -42,6 +42,36 @@ jobs:
           path: dist/*
           if-no-files-found: error
 
+      # Ship every locally built apk (kernel, modemmanager, libqmi, imsd,
+      # callaudioshim, audio files, ...) to the Forgejo Alpine registry, so
+      # installed systems get updates via 'apk upgrade' instead of losing
+      # the FP6 patches to the next upstream version bump. Requires the
+      # PACKAGE_TOKEN repo secret (catbot account, package:write scope);
+      # skips quietly until it exists. 409 = same version already published.
+      - name: Publish packages to the apk registry
+        env:
+          PACKAGE_TOKEN: ${{ secrets.PACKAGE_TOKEN }}
+        run: |
+          if [ -z "$PACKAGE_TOKEN" ]; then
+            echo "no PACKAGE_TOKEN secret configured; skipping package publish"
+            exit 0
+          fi
+          apk add -q curl
+          found=0
+          for f in /home/build/.local/var/pmbootstrap/packages/*/aarch64/*.apk; do
+            [ -e "$f" ] || continue
+            found=1
+            code=$(curl -s -o /dev/null -w '%{http_code}' \
+              --user "catbot:$PACKAGE_TOKEN" --upload-file "$f" \
+              "https://forgejo.catcrafts.net/api/packages/Catcrafts/alpine/edge/fp6")
+            case "$code" in
+              201) echo "published: $(basename "$f")" ;;
+              409) echo "already published: $(basename "$f")" ;;
+              *)   echo "FAILED ($code): $(basename "$f")"; exit 1 ;;
+            esac
+          done
+          [ "$found" = 1 ] || { echo "no packages found to publish"; exit 1; }
+
       - name: Update rolling 'latest' tag
         run: |
           git config --global --add safe.directory "$PWD"

aports/device/catcrafts-fp6-repo/APKBUILD

@@ -0,0 +1,31 @@
+# Enables the Catcrafts FP6 package repository on the installed system:
+# installs the Forgejo package-registry signing key and appends the repo URL
+# to /etc/apk/repositories. With this, 'apk upgrade' pulls the CI-published
+# kernel/modemmanager/libqmi/imsd builds instead of losing the FP6 patches
+# to the next upstream version bump.
+maintainer="Jorijn van der Graaf <jorijnvdgraaf@catcrafts.net>"
+pkgname=catcrafts-fp6-repo
+pkgver=1
+pkgrel=0
+pkgdesc="Catcrafts FP6 apk repository (signing key + repositories entry)"
+url="https://forgejo.catcrafts.net/Catcrafts/-/packages"
+arch="noarch"
+license="MIT"
+options="!check"
+install="$pkgname.post-install $pkgname.post-upgrade"
+_keyname="catcrafts@f79ff8fc14285f7824dd6a8c36ac814751da19ab7ed47c516f089a311ab7fe57.rsa.pub"
+source="
+	$_keyname
+	$pkgname.post-install
+	$pkgname.post-upgrade
+"
+
+package() {
+	install -Dm644 "$srcdir/$_keyname" "$pkgdir/etc/apk/keys/$_keyname"
+}
+
+sha512sums="
+3ea75c60a7df9f7ff96cedf1c5e54d0f3b95f85e08001de0a3cc01227c7772b1fdde9d05e3d6331ee39875dfd8151536b45db735231a48b50c38dd98bc1036f8  catcrafts@f79ff8fc14285f7824dd6a8c36ac814751da19ab7ed47c516f089a311ab7fe57.rsa.pub
+676c97c31729c49d87ce1c2421540e92cb602b27fd0eb09f5fc3925fae1529d917c0cf145bc7e7c33067baa63d05bf6ab4074640f3c2c18a90aa6e41a5c80d79  catcrafts-fp6-repo.post-install
+676c97c31729c49d87ce1c2421540e92cb602b27fd0eb09f5fc3925fae1529d917c0cf145bc7e7c33067baa63d05bf6ab4074640f3c2c18a90aa6e41a5c80d79  catcrafts-fp6-repo.post-upgrade
+"

aports/device/catcrafts-fp6-repo/catcrafts-fp6-repo.post-install

@@ -0,0 +1,3 @@
+#!/bin/sh
+repo="https://forgejo.catcrafts.net/api/packages/Catcrafts/alpine/edge/fp6"
+grep -qxF "$repo" /etc/apk/repositories 2>/dev/null || echo "$repo" >> /etc/apk/repositories

aports/device/catcrafts-fp6-repo/catcrafts-fp6-repo.post-upgrade

@@ -0,0 +1,3 @@
+#!/bin/sh
+repo="https://forgejo.catcrafts.net/api/packages/Catcrafts/alpine/edge/fp6"
+grep -qxF "$repo" /etc/apk/repositories 2>/dev/null || echo "$repo" >> /etc/apk/repositories

aports/device/catcrafts-fp6-repo/catcrafts@f79ff8fc14285f7824dd6a8c36ac814751da19ab7ed47c516f089a311ab7fe57.rsa.pub

@@ -0,0 +1,14 @@
+-----BEGIN PUBLIC KEY-----
+MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAy/+uHbGSSInYMlrtMWnF
+4p+eXmV1L3Ief0H1AJSnJVPKW3PIQ9FEQScUhnrOYAvo3CgZZHJ/mdGt5bbuS+2Z
+5obGq+UM6Aq3ovyt9aYBA6i5AZ/OsxTwT6Y192MuOIqzvZfYQHnxYxCk4Mp6FKpM
+8zfr5QQSR4fDEJGwOyVauxNWC/ALEe4l5K+ZLEFv3xDSG0jPBTSsGuY8RO4eUAnN
+oJKh7VPhniqTAhAp9fus7U1I0gXR03FzTkeo/zu9AriasPiddGJ7Xn7JW/0j3nSD
+lVAQx9e/FsggMwB5a+lRKq9rEE6W6ChZNqVX4yzayvgBlEGkwVjQeHUAjq3OfV+x
+0nQglxTBibulXm8WaK4XCQ2ff4wQAMXWrpgC2Ppjj+C0TOoX7c0oJEeAR7ngxP5F
+Cl4vMpGPNo0eHa1FqTa1z8PMrVglybyLaAlumPV6GxBl9QxPRPE5q4Bhadwncj0S
+aRXdAcgDeoM4UPLO7NXWWN62vjiTHrnErdB+ytxuwWcNsuK+YhbfaAv93o9s7it/
+vEizl/a9f8+f7IHsnNEdklpvgIAaccK9szpxeGwjlCbJNvR4Z+ybKEovQsOvWgGF
+MsiIXf75jyMy/hVFJM7+R6V2QhTzzsSysqE9JuIRpjeW/R5XoBtHLKxbZuURA/3a
+QmAoYTGqgKVvkdnEItTmr5sCAwEAAQ==
+-----END PUBLIC KEY-----