An updater: what is published on Gitea, and installing it from Settings

A new selfupdate package asks one URL what the newest build is — a Gitea/Forgejo repo
API base, or any directory holding VERSION, SHA256SUMS and hamlab-linux-<arch>, which is
what make release already writes and what install.sh already downloads. The binary is
checked against SHA256SUMS before it goes near the running one, and a token is sent when
the source is behind a login, so a private Gitea serves its own fleet without opening the
instance to everyone. Version ordering is install.sh's vnum rule, so the daemon and the
installer never disagree about which build is newer.

Settings gains an Updates card: installed, published, when it last looked, the source,
release notes, Check for updates, and Install. The rail badges Settings when a newer
build is out. Nothing installs unasked — it restarts the daemon and drops terminals.

scripts/gitea-release.sh (make gitea-release) publishes dist/ as a Gitea release.
Deliberate, and not part of deploy: deploy pushes to the machines this hub owns,
publishing offers the build to every install anywhere.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

scripts/gitea-release.sh

@@ -0,0 +1,69 @@
+#!/bin/sh
+# Publish what `make release` built as a release on Gitea, which is where every Ham Lab
+# looks for a newer build (Settings → Updates, and `update.url` in config.json).
+#
+#   make release && scripts/gitea-release.sh [--force]
+#
+# The token needs write:repository and is read from $HAMLAB_PUBLISH_TOKEN, else from
+# ~/.config/hamlab-publish-token. It is never printed.
+#
+# A release is a deliberate act, not part of `make deploy`: deploying pushes this build to
+# the machines this hub owns, while publishing offers it to every install everywhere.
+set -eu
+
+REPO=${HAMLAB_REPO:-https://git.bigham.dev/api/v1/repos/mitchell/hamlab}
+DIST=${DIST:-dist}
+FORCE=0
+[ "${1:-}" != "--force" ] || FORCE=1
+
+die() { printf '%s\n' "$*" >&2; exit 1; }
+
+[ -f "$DIST/VERSION" ] || die "no $DIST/VERSION — run: make release"
+VERSION=$(head -n 1 "$DIST/VERSION" | tr -cd 'A-Za-z0-9._+-')
+[ -n "$VERSION" ] || die "$DIST/VERSION is empty"
+
+TOKEN=${HAMLAB_PUBLISH_TOKEN:-}
+if [ -z "$TOKEN" ] && [ -r "$HOME/.config/hamlab-publish-token" ]; then
+  TOKEN=$(cat "$HOME/.config/hamlab-publish-token")
+fi
+[ -n "$TOKEN" ] || die "no publish token: set HAMLAB_PUBLISH_TOKEN or write ~/.config/hamlab-publish-token (Gitea → Settings → Applications, scope write:repository)"
+
+api() { # method path [curl args...]
+  m=$1; p=$2; shift 2
+  curl -sS -X "$m" -H "Authorization: token $TOKEN" "$REPO$p" "$@"
+}
+
+SHA=$(git rev-parse HEAD)
+echo "publishing $VERSION ($(echo "$SHA" | cut -c1-8)) to $REPO"
+
+# An existing release for this version is replaced only when asked: re-publishing a version
+# with different binaries is how an install ends up with something nobody can reproduce.
+existing=$(api GET "/releases/tags/$VERSION" | python3 -c 'import json,sys
+try: d = json.load(sys.stdin)
+except Exception: d = {}
+print(d.get("id") or "")' 2>/dev/null || true)
+if [ -n "$existing" ]; then
+  [ "$FORCE" = 1 ] || die "$VERSION is already published (release $existing). Re-publish with --force."
+  echo "  replacing release $existing"
+  api DELETE "/releases/$existing" -o /dev/null
+fi
+
+notes=$(git log -1 --pretty=%B | head -20)
+payload=$(python3 -c 'import json,sys; print(json.dumps({"tag_name": sys.argv[1], "target": sys.argv[2], "name": sys.argv[1], "body": sys.argv[3], "draft": False, "prerelease": False}))' "$VERSION" "$SHA" "$notes")
+id=$(printf '%s' "$payload" | api POST /releases -H 'Content-Type: application/json' -d @- | python3 -c 'import json,sys
+d = json.load(sys.stdin)
+if not d.get("id"): sys.exit("gitea refused the release: %s" % d.get("message", d))
+print(d["id"])')
+[ -n "$id" ] || die "could not create the release"
+echo "  release $id created"
+
+n=0
+for f in "$DIST"/hamlab-linux-* "$DIST/SHA256SUMS" "$DIST/install.sh" "$DIST/VERSION"; do
+  [ -f "$f" ] || continue
+  name=$(basename "$f")
+  api POST "/releases/$id/assets?name=$name" -F "attachment=@$f" -o /dev/null
+  n=$((n + 1))
+  echo "  + $name"
+done
+echo "published $VERSION with $n assets"
+echo "  every Ham Lab pointed at this repo will offer it in Settings → Updates"