Releases and updates

A version is cut by tagging; CI does the rest. The tag v0.8.10 builds .deb and .rpm for amd64 and arm64, signs the checksum list with an ed25519 key held as a repository secret and publishes the release; the annotated tag's message becomes the release notes.

make keygen                  # once: a signing key pair (the private half becomes the secret)
make release VERSION=0.8.10  # tag and push; CI builds and publishes
make packages VERSION=0.8.10 # the same artefacts locally, without publishing

On a server:

mp update trust --key <public key>   # written to config.yaml, which only root may write
mp update settings --repo owner/name # --token-stdin for a private repository
mp update                            # what is installed and what is available
mp update apply                      # download, verify, install, restart

Checks run on a schedule (daily by default) and --auto-apply installs what they find. The panel does not install the package itself: the agent starts a transient monopanel-update.service, which survives the restart of both daemons and restores the previous binary if the new version fails to answer. While a key is pinned, an unsigned release will not install. A slow link is fine: the package download has no overall deadline, only a stalled stream is given up.