"me-web?" 0.13.0: updates on Linux arrive through your package manager

- Installing the deb or the rpm now also adds the Arasaka package repository, packages.arasaka.software, so later versions of “me-web?” arrive through apt, dnf, zypper or your software centre, like any other program. - The rpm is now signed. On openSUSE, import the key once with sudo rpm --import https://packages.arasaka.software/arasaka.asc - Removing the package keeps the repository until no Arasaka package is left (purge on Debian and Ubuntu); a repository file you edited by hand is never touched. - The download and privacy pages say so; the repository server keeps no access log. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012CzABvBkbcFqoHdmi8b9WB
2026-10-16 22:05:08 +02:00
1 parent 50c40195d3
commit 91c92c80e9
@@ -43,6 +43,16 @@ jobs:
          MEWEB_KEYSTORE_PASS: ${{ secrets.MEWEB_KEYSTORE_PASS }}
        run: .gitea/scripts/android.sh

+      - name: The deb and rpm on packages.arasaka.software, the rpm signed
+        if: ${{ github.ref_type == 'tag' }}
+        env:
+          YOLO_TOKEN: ${{ secrets.YOLO_TOKEN }}
+          YOLO_GITEA: http://localhost:3000
+          YOLO_MIN: "0.1.0"
+        run: |
+          yolo repo submit --project meweb --version "$VERSION" --replace-signed "releases/$VERSION/MeWeb-$VERSION-linux-x64.deb" "releases/$VERSION/MeWeb-$VERSION-linux-x64.rpm"
+          yolo sums "releases/$VERSION"
+
      - name: Publish the release
        if: ${{ github.ref_type == 'tag' || inputs.publish == 'true' }}
        env:
@@ -143,6 +143,13 @@ The Android release key: alias `meweb`, certificate SHA-256
  the network and the block without the publisher's server. A change to any knowledge file's format bumps
  `KnowledgeFeeder.Format` and the `"format":N` that `wait-knowledge.sh` waits for: the feeder rebuilds only when a
  source changes or the format differs, and a release must not embed the previous build.
+- **The deb and rpm reach packages.arasaka.software through YoloCICD.** `release.yml` runs `yolo repo submit
+  --replace-signed` on tags (org secret `YOLO_TOKEN`, `yolo` installed on nuvola by YoloCICD): the files go to the
+  bot's private inbox, YoloCICD's `publish.yml` checks this run against the tag, signs the rpm, gates on an upgrade
+  check in containers and publishes; the signed rpm replaces the local one, then `yolo sums` rewrites SHA256SUMS.
+  `packaging/arasaka-repository.sh` is generated (`yolo repo kit --out`, never edited by hand) and is written into
+  both maintainer scripts by `tools/release.cs`; the package owns `/usr/share/arasaka-repository/meweb`, the marker
+  that keeps the repository configured while any Arasaka package is installed.
 - **The server cannot ping**: `NoNewPrivileges` drops `ping`'s file capability and `ping_group_range` is closed, so
  the trace back to a caller uses `tracepath` (UDP, unprivileged) and keeps only public hops outside `Probe:Refuse`,
  so the box's own network never reaches an app.
@@ -1,6 +1,6 @@
 <Project>
  <PropertyGroup>
-    <Version>0.12.0</Version>
+    <Version>0.13.0</Version>
    <Product>“me-web?”</Product>
    <Company>Arasaka di Hvozdikov Yevheniy</Company>
    <Copyright>© 2026 Arasaka di Hvozdikov Yevheniy</Copyright>
@@ -47,6 +47,12 @@ Planned: the builds for Mac announced once they have been tried on a real Mac.

 Linux (deb, rpm), Windows, macOS and Android. Builds are published as releases of this repository.

+On Linux the deb and the rpm add the Arasaka package repository, packages.arasaka.software, when they are installed,
+so later versions arrive through the package manager. The rpm is signed with the repository's key; on openSUSE,
+import it first with `sudo rpm --import https://packages.arasaka.software/arasaka.asc`. The script the packages run
+is `packaging/arasaka-repository.sh`, generated by YoloCICD (`yolo repo kit`); it never calls the package manager,
+leaves files you edited alone, and removes the repository only when no Arasaka package is left (purge or erase).
+
 ## Privacy

 “me-web?” sends nothing anywhere unless a check needs it, and lists every host it contacts ("What this app contacts"
@@ -0,0 +1,126 @@
+arasaka_repository_url='https://packages.arasaka.software'
+arasaka_repository_known=' 39c1037ea150a946870135d45c7e0a150b6cf07612961ab7d4ebf7356e3d6206 8e98c23290cd1afa016eed46b6bc6643a44f07d1d398b4c74221891a3dee0ef1 f8a29b044c4b538af072041b201e31cbcc6328f709c3b960fbfccef819cb2572 fe762297efbcb217cbfa51ac28dce057695205bd46f59bc69369d92765edebfc '
+arasaka_repository_sources='Types: deb
+URIs: https://packages.arasaka.software/apt
+Suites: stable
+Components: main
+Architectures: amd64
+Signed-By:
+ -----BEGIN PGP PUBLIC KEY BLOCK-----
+ .
+ mQINBGrSft8BEAC02AviPvhvjkSZooT5/n9pNBivqRr2xwr75RVLaPh9qhYV3X5R
+ fyYjvMatwqqDvF83JqUjkvweTxTu+GpvkFNuvBTF5ZbOdzp5GLo/4LzLmCP1dNsP
+ WkIGkDEa4b+VzuOYc1jglIncfmcnoEj8nufPXsCINTQcWv1WSB5VhWjdovdZDSHI
+ TSZs01BmaTupQhbDelpv4r52YnnH4god25QcImgdSF8aO4bYCeMO3NFoQfSBcnou
+ tDQjJ7JhSSCX+/K2hzbgGDhep2DL9ndsNZuUN5GokwQUM5cVsyoR/A2VdwkWvzLl
+ ib9IwngTjVRLCAm+XkPhL/0GHBtV+oOz4s+RWKtGC2qmWMXUfdjOyLsxAIGy8wgc
+ dcvBoK77INSTccYUGCDAGOoQHnD8USNjTCOcsajHy/FpaNxihrjq1C16LXKEMEIw
+ eK75YbWP8BzClEKZ7wd+0QMlo4CNJEE6mVEZe1R+yC8FEmP86qQR2wpG8IBrYwln
+ +IyYIII1GLDUewjRcwo0mYbuvC4LQtDXpm9WrMP9GyAd60glBHPRYhE7GLHDBxNi
+ CjLQ9vnB+zzmDD7LvIzHNb3t0lG118p1RmazsvyBbPGCC/pIxiofimglRXmawsxs
+ 06dzA57CWprlZEP5/hU9mKxSUYKFboUh3+LRyTwU0/EPM2KQ22yQE3ORcwARAQAB
+ tCxBcmFzYWthIHBhY2thZ2VzIChwYWNrYWdlcy5hcmFzYWthLnNvZnR3YXJlKYkC
+ UQQTAQoAOxYhBPksFm6bHBPt0WKedoiNz5adEz+yBQJq0n7fAhsDBQsJCAcCAiIC
+ BhUKCQgLAgQWAgMBAh4HAheAAAoJEIiNz5adEz+y66oQAJl49Hd0/fuAOjckFkSH
+ u/LBspsmVO58Sa2QbZn85VGHhmRi2RqrJfIbRXl2SnmbpTE+q4aMSOCAjvodPEh9
+ JkiU3nl8HXL7e6tVp7VMsC2zk0GRGZ+R3+KaWbb4xCiIF4Gly4vtcQL1u+tRl0GO
+ 5yb5OXAYgGktaBSjMSe/ZFATrb2pbbWtLozpLBrEKJel8kYZg6ogrDepf08KbS5d
+ ZajlVJltlDu93s7fkGt/+CSlDBRSvIsg6VsD9FaCB1XsfRt9nmldH5DeKsPCiohn
+ d7KeYPntE0fr+x1NM5hKolZs6E7N3Z7iHHVIt7wzfl35EnJyzGSGUXWAT6dYrN1o
+ VzkHzQS+KWzAhFnfZtQFHcwZxSTXpX4Q0ORshs8aO7Pzb1Uq4jWYBwoW7/rEV3si
+ 1H4BEol8/MtmsdjC9udDSZWMpu4JVZey2y5J+tnjuHJO4kgj5bVrmOGWvy0dTCu4
+ ute3grHGR7wrjxsNUdUljsUu/q85+rJ0wx7GmmKlwISGmGr/LaHPza25aAQwzjQE
+ rN+vQB98iHplrv+6KM5lfs+wTh5ajrHTV3yW5aoDWHHJDFWrTzWu18enrUxwlF5k
+ o6rC8YtE28cCw4XQHP4blvJEwZWhln61IFDvyOQsQhdJPaSTVHnLZj8Q79KH8Odc
+ r2UH5jw/3noMMPLA+GMyfUdq
+ =FhjR
+ -----END PGP PUBLIC KEY BLOCK-----
+'
+arasaka_repository_key='-----BEGIN PGP PUBLIC KEY BLOCK-----
+
+mQINBGrSft8BEAC02AviPvhvjkSZooT5/n9pNBivqRr2xwr75RVLaPh9qhYV3X5R
+fyYjvMatwqqDvF83JqUjkvweTxTu+GpvkFNuvBTF5ZbOdzp5GLo/4LzLmCP1dNsP
+WkIGkDEa4b+VzuOYc1jglIncfmcnoEj8nufPXsCINTQcWv1WSB5VhWjdovdZDSHI
+TSZs01BmaTupQhbDelpv4r52YnnH4god25QcImgdSF8aO4bYCeMO3NFoQfSBcnou
+tDQjJ7JhSSCX+/K2hzbgGDhep2DL9ndsNZuUN5GokwQUM5cVsyoR/A2VdwkWvzLl
+ib9IwngTjVRLCAm+XkPhL/0GHBtV+oOz4s+RWKtGC2qmWMXUfdjOyLsxAIGy8wgc
+dcvBoK77INSTccYUGCDAGOoQHnD8USNjTCOcsajHy/FpaNxihrjq1C16LXKEMEIw
+eK75YbWP8BzClEKZ7wd+0QMlo4CNJEE6mVEZe1R+yC8FEmP86qQR2wpG8IBrYwln
+IyYIII1GLDUewjRcwo0mYbuvC4LQtDXpm9WrMP9GyAd60glBHPRYhE7GLHDBxNi
+CjLQ9vnB+zzmDD7LvIzHNb3t0lG118p1RmazsvyBbPGCC/pIxiofimglRXmawsxs
+06dzA57CWprlZEP5/hU9mKxSUYKFboUh3+LRyTwU0/EPM2KQ22yQE3ORcwARAQAB
+tCxBcmFzYWthIHBhY2thZ2VzIChwYWNrYWdlcy5hcmFzYWthLnNvZnR3YXJlKYkC
+UQQTAQoAOxYhBPksFm6bHBPt0WKedoiNz5adEz+yBQJq0n7fAhsDBQsJCAcCAiIC
+BhUKCQgLAgQWAgMBAh4HAheAAAoJEIiNz5adEz+y66oQAJl49Hd0/fuAOjckFkSH
+u/LBspsmVO58Sa2QbZn85VGHhmRi2RqrJfIbRXl2SnmbpTE+q4aMSOCAjvodPEh9
+JkiU3nl8HXL7e6tVp7VMsC2zk0GRGZ+R3+KaWbb4xCiIF4Gly4vtcQL1u+tRl0GO
+5yb5OXAYgGktaBSjMSe/ZFATrb2pbbWtLozpLBrEKJel8kYZg6ogrDepf08KbS5d
+ZajlVJltlDu93s7fkGt/+CSlDBRSvIsg6VsD9FaCB1XsfRt9nmldH5DeKsPCiohn
+d7KeYPntE0fr+x1NM5hKolZs6E7N3Z7iHHVIt7wzfl35EnJyzGSGUXWAT6dYrN1o
+VzkHzQS+KWzAhFnfZtQFHcwZxSTXpX4Q0ORshs8aO7Pzb1Uq4jWYBwoW7/rEV3si
+1H4BEol8/MtmsdjC9udDSZWMpu4JVZey2y5J+tnjuHJO4kgj5bVrmOGWvy0dTCu4
+ute3grHGR7wrjxsNUdUljsUu/q85+rJ0wx7GmmKlwISGmGr/LaHPza25aAQwzjQE
+rN+vQB98iHplrv+6KM5lfs+wTh5ajrHTV3yW5aoDWHHJDFWrTzWu18enrUxwlF5k
+o6rC8YtE28cCw4XQHP4blvJEwZWhln61IFDvyOQsQhdJPaSTVHnLZj8Q79KH8Odc
+r2UH5jw/3noMMPLA+GMyfUdq
+=FhjR
+-----END PGP PUBLIC KEY BLOCK-----
+'
+arasaka_repository_dnf='[arasaka]
+name=Arasaka
+baseurl=https://packages.arasaka.software/rpm/
+enabled=1
+type=rpm-md
+gpgcheck=1
+repo_gpgcheck=1
+gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-arasaka
+priority=150
+metadata_expire=6h
+'
+arasaka_repository_zypp='[arasaka]
+name=Arasaka
+baseurl=https://packages.arasaka.software/rpm/
+enabled=1
+autorefresh=1
+type=rpm-md
+gpgcheck=1
+repo_gpgcheck=1
+gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-arasaka
+priority=150
+'
+arasaka_repository_write() {
+  [ -d "${1%/*}" ] || return 0
+  if [ -f "$1" ]; then
+    arasaka_repository_old=$(sha256sum "$1" | cut -d ' ' -f 1)
+    [ "$arasaka_repository_old" = "$(printf '%s' "$2" | sha256sum | cut -d ' ' -f 1)" ] && return 0
+    case "$arasaka_repository_known" in *" $arasaka_repository_old "*) ;; *) echo "arasaka-repository: $1 was changed by hand, left as it is"; return 0 ;; esac
+  fi
+  printf '%s' "$2" > "$1.arasaka-new" && chmod 644 "$1.arasaka-new" && mv -f "$1.arasaka-new" "$1"
+}
+arasaka_repository_elsewhere() {
+  grep -rlsF "$arasaka_repository_url" "$@" 2>/dev/null | grep -qvx -e /etc/apt/sources.list.d/arasaka.sources -e /etc/yum.repos.d/arasaka.repo -e /etc/zypp/repos.d/arasaka.repo
+}
+arasaka_repository_configure() {
+  case "${1:-}" in
+    configure)
+      arasaka_repository_elsewhere /etc/apt/sources.list /etc/apt/sources.list.d && return 0
+      arasaka_repository_write /etc/apt/sources.list.d/arasaka.sources "$arasaka_repository_sources" ;;
+    [0-9]*)
+      mkdir -p /etc/pki/rpm-gpg
+      arasaka_repository_write /etc/pki/rpm-gpg/RPM-GPG-KEY-arasaka "$arasaka_repository_key"
+      arasaka_repository_elsewhere /etc/yum.repos.d /etc/zypp/repos.d && return 0
+      arasaka_repository_write /etc/yum.repos.d/arasaka.repo "$arasaka_repository_dnf"
+      arasaka_repository_write /etc/zypp/repos.d/arasaka.repo "$arasaka_repository_zypp" ;;
+  esac
+  return 0
+}
+arasaka_repository_cleanup() {
+  case "${1:-}" in purge|0) ;; *) return 0 ;; esac
+  [ -n "$(ls -A /usr/share/arasaka-repository 2>/dev/null)" ] && return 0
+  for arasaka_repository_file in /etc/apt/sources.list.d/arasaka.sources /etc/yum.repos.d/arasaka.repo /etc/zypp/repos.d/arasaka.repo /etc/pki/rpm-gpg/RPM-GPG-KEY-arasaka; do
+    [ -f "$arasaka_repository_file" ] || continue
+    case "$arasaka_repository_known" in *" $(sha256sum "$arasaka_repository_file" | cut -d ' ' -f 1) "*) rm -f "$arasaka_repository_file" ;; esac
+  done
+  rmdir /usr/share/arasaka-repository 2>/dev/null || true
+  return 0
+}
@@ -24,6 +24,7 @@ public static class DownloadPage
      ["WindowsNote"] = "The file isn't signed with a paid certificate, so Windows may say it protected your PC: choose “More info”, then “Run anyway”.",
      ["Linux"] = "Linux",
      ["LinuxNote"] = "Install with your package manager, for example",
+      ["LinuxRepo"] = "Installing it also adds the Arasaka package repository, packages.arasaka.software, so your package manager brings the updates. On openSUSE, first run",
      ["Mac"] = "Apple computers",
      ["MacNote"] = "Builds for Mac are attached to the release, but they haven't been tried on a Mac yet.",
      ["Sums"] = "Checksums (SHA-256)",
@@ -46,6 +47,7 @@ public static class DownloadPage
      ["WindowsNote"] = "Il file non è firmato con un certificato a pagamento, quindi Windows può dire di aver protetto il PC: scelga “Ulteriori informazioni”, poi “Esegui comunque”.",
      ["Linux"] = "Linux",
      ["LinuxNote"] = "Si installa con il gestore dei pacchetti, per esempio",
+      ["LinuxRepo"] = "Installandolo si aggiunge anche il repository dei pacchetti Arasaka, packages.arasaka.software, e gli aggiornamenti arrivano dal gestore dei pacchetti. Su openSUSE esegua prima",
      ["Mac"] = "Computer Apple",
      ["MacNote"] = "Le versioni per Mac sono allegate alla release, ma non sono ancora state provate su un Mac.",
      ["Sums"] = "Somme di controllo (SHA-256)",
@@ -79,7 +81,7 @@ public static class DownloadPage
      var deb = ReleaseFeed.Asset(release, "linux-deb")?.Name;
      var rpm = ReleaseFeed.Asset(release, "linux-rpm")?.Name;
      Block(html, release, words["Linux"], [("linux-deb", ".deb · Debian, Ubuntu"), ("linux-rpm", ".rpm · Fedora, openSUSE")],
-        $"{E(words["LinuxNote"])} <code>sudo apt install ./{E(deb)}</code> · <code>sudo dnf install ./{E(rpm)}</code>");
+        $"{E(words["LinuxNote"])} <code>sudo apt install ./{E(deb)}</code> · <code>sudo dnf install ./{E(rpm)}</code>. {E(words["LinuxRepo"])} <code>sudo rpm --import https://packages.arasaka.software/arasaka.asc</code>.");
      Block(html, release, words["Mac"], [("macos-arm64", "Apple Silicon"), ("macos-x64", "Intel")], E(words["MacNote"]));
      html.Append($"<p><a href=\"{Endpoints.Downloads.GET_M_Platform("checksums")}\">{E(words["Sums"])}</a> · <a href=\"{E(release.Page ?? Endpoints.Gitea.Releases)}\">{E(words["All"])}</a></p>");
    }
@@ -7,7 +7,7 @@ public static class PrivacyPage
 {
  static readonly Dictionary<string, (string Title, string Other, string Publisher, string Footer, string[] Sections)> Texts = new()
  {
-    ["en"] = ("“me-web?” · privacy", "Italiano", "Published by Arasaka di Hvozdikov Yevheniy, Busto Arsizio, Italy · VAT IT03929200123", "Last changed 15 October 2026.",
+    ["en"] = ("“me-web?” · privacy", "Italiano", "Published by Arasaka di Hvozdikov Yevheniy, Busto Arsizio, Italy · VAT IT03929200123", "Last changed 16 October 2026.",
    [
      "## Who is responsible",
      "Arasaka di Hvozdikov Yevheniy, a sole trader in Busto Arsizio (VA), Italy, VAT number IT03929200123, publishes “me-web?” and runs its server, meweb.arasaka.software, on its own hardware in Italy. Questions and requests: through the form at [https://arasaka.software/contact](https://arasaka.software/contact).",
@@ -19,12 +19,14 @@ public static class PrivacyPage
      "If you press “Send” after reading exactly what will be sent, the server stores those findings, which include your public addresses, your provider, your router's make and model and the results of the checks, as a file on the same server in Italy. The purpose is to improve the notes on providers in later versions of “me-web?”; only totals without addresses are ever published, after a person has reviewed them, and only for a provider whose findings come from at least five different networks, four in five of them agreeing; the total says how many. The legal basis is your consent (Article 6(1)(a) GDPR). Each submission is deleted automatically after twelve months, or earlier when you delete it in the app, or ask for it with its code (MW-…).",
      "## The STUN servers",
      "To see how your router or your provider translates addresses for calls and games, the app sends one short message to stun.nextcloud.com, run by Nextcloud GmbH in Germany, which sees your public address as any server you contact does, and about twenty to stun.meweb.arasaka.software, run by the publisher, some of them two minutes apart to see how long an idle connection stays open.",
+      "## Updates on Linux",
+      "If you install the Linux package, it adds the Arasaka package repository to your system, and your package manager then checks packages.arasaka.software for updates, as it does with every repository it knows. That server keeps no access log.",
      "## Nothing else",
      "No cookies, no analytics, no advertising, no crash reports. The app keeps your earlier checks on your device only, and you can forget them in the app.",
      "## Your rights",
      "You can ask for access to, correction or erasure of your data, restrict its use, take it with you, and withdraw your consent at any time, through the form above. You can also complain to the Italian supervisory authority, the Garante per la protezione dei dati personali ([https://www.garanteprivacy.it](https://www.garanteprivacy.it)).",
    ]),
-    ["it"] = ("«me-web?» · privacy", "English", "Pubblicato da Arasaka di Hvozdikov Yevheniy, Busto Arsizio · P.IVA 03929200123", "Ultima modifica 15 ottobre 2026.",
+    ["it"] = ("«me-web?» · privacy", "English", "Pubblicato da Arasaka di Hvozdikov Yevheniy, Busto Arsizio · P.IVA 03929200123", "Ultima modifica 16 ottobre 2026.",
    [
      "## Chi è responsabile",
      "Arasaka di Hvozdikov Yevheniy, ditta individuale di Busto Arsizio (VA), P.IVA 03929200123, pubblica «me-web?» e gestisce il suo server, meweb.arasaka.software, su hardware proprio in Italia. Domande e richieste: con il modulo su [https://arasaka.software/it/contatti](https://arasaka.software/it/contatti).",
@@ -36,6 +38,8 @@ public static class PrivacyPage
      "Se preme «Invia» dopo aver letto esattamente che cosa verrà inviato, il server conserva quei risultati, che comprendono i suoi indirizzi pubblici, l'operatore, marca e modello del router e gli esiti delle verifiche, come file sullo stesso server in Italia. Lo scopo è migliorare le note sugli operatori nelle prossime versioni di «me-web?»; si pubblicano solo totali senza indirizzi, dopo la revisione di una persona, e solo per un operatore i cui risultati vengono da almeno cinque reti diverse, d'accordo almeno quattro volte su cinque; il totale dice quante. La base giuridica è il suo consenso (art. 6, par. 1, lett. a GDPR). Ogni invio viene cancellato automaticamente dopo dodici mesi, oppure prima, quando lo cancella nell'app o lo chiede indicando il suo codice (MW-…).",
      "## I server STUN",
      "Per vedere come il router o l'operatore traducono gli indirizzi per chiamate e giochi, l'app invia un breve messaggio a stun.nextcloud.com, gestito da Nextcloud GmbH in Germania, che vede il suo indirizzo pubblico come qualsiasi server che lei contatta, e una ventina a stun.meweb.arasaka.software, gestito dall'editore, alcuni a due minuti di distanza per vedere quanto resta aperta una connessione inattiva.",
+      "## Gli aggiornamenti su Linux",
+      "Se installa il pacchetto per Linux, questo aggiunge al sistema il repository dei pacchetti Arasaka, e il gestore dei pacchetti controlla poi gli aggiornamenti su packages.arasaka.software, come fa con ogni repository che conosce. Quel server non tiene registri di accesso.",
      "## Nient'altro",
      "Niente cookie, niente statistiche, niente pubblicità, niente rapporti sugli arresti anomali. L'app conserva le verifiche precedenti solo sul suo dispositivo, e può dimenticarle dall'app.",
      "## I suoi diritti",
@@ -138,14 +138,16 @@ string Linux()
      StartupWMClass=meweb

      """);
-  File.WriteAllText(Path.Combine(stage, "postinstall.sh"), """
+  var caches = """
      #!/bin/sh
      if command -v update-desktop-database >/dev/null 2>&1; then update-desktop-database -q /usr/share/applications || true; fi
      if command -v gtk-update-icon-cache >/dev/null 2>&1; then gtk-update-icon-cache -q -f -t /usr/share/icons/hicolor || true; fi
-      exit 0

-      """);
-  File.Copy(Path.Combine(stage, "postinstall.sh"), Path.Combine(stage, "postremove.sh"), overwrite: true);
+      """;
+  var kit = File.ReadAllText(Path.Combine(root, "packaging", "arasaka-repository.sh"));
+  File.WriteAllText(Path.Combine(stage, "postinstall.sh"), $"{caches}{kit}arasaka_repository_configure \"$@\"\nexit 0\n");
+  File.WriteAllText(Path.Combine(stage, "postremove.sh"), $"{caches}{kit}arasaka_repository_cleanup \"$@\"\nexit 0\n");
+  File.WriteAllText(Path.Combine(stage, "arasaka-repository"), "");
  var png = Path.Combine(branding, "meweb-512.png");
  var svg = Path.Combine(branding, "meweb.svg");
  var yaml = Path.Combine(stage, "nfpm.yaml");
@@ -183,6 +185,10 @@ string Linux()
          dst: /usr/share/icons/hicolor/scalable/apps/software.arasaka.meweb.svg
          file_info:
            mode: 0644
+        - src: {stage}/arasaka-repository
+          dst: /usr/share/arasaka-repository/meweb
+          file_info:
+            mode: 0644
      scripts:
        postinstall: {stage}/postinstall.sh
        postremove: {stage}/postremove.sh
@@ -8,9 +8,10 @@ done
 if [ -z "$dotnet_dir" ]; then
  dotnet_dir="$HOME/.dotnet"
  echo ".NET SDK $sdk not found: installing it into $dotnet_dir"
-  script="${TMPDIR:-/tmp}/dotnet-install.sh"
+  script=$(mktemp "${TMPDIR:-/tmp}/dotnet-install.XXXXXX")
  curl -fsSL https://dot.net/v1/dotnet-install.sh -o "$script"
  bash "$script" --version "$sdk" --install-dir "$dotnet_dir"
+  rm -f "$script"
 fi
 export DOTNET_ROOT="$dotnet_dir" PATH="$dotnet_dir:$PATH" DOTNET_CLI_TELEMETRY_OPTOUT=1 DOTNET_NOLOGO=1
 cd "$root"