The release tooling is public now, and so is everything else

[MTSistemi]

SkillFishOS calls itself open source, so the code that turns a build into something you can
install should be readable too. Four scripts used to run only on our services container and
existed nowhere else. They are in repo-server/bin/:

Script	What it does
skillfish-rilascio	puts .deb files into the aetherium suite with reprepro and regenerates the signed indexes
skillfish-carica-ovh	uploads the signed archive to the mirror over SFTP
skillfish-archivia	uploads release images to the Internet Archive
skillfish-stat-sourceforge	pulls per-file download counts for the statistics page

None of them contains a credential — each reads ~/.skillfishos/*.env, and the templates to
fill in sit next to the scripts. The one thing that was hard-coded, the address of the build
machine, is now $SKILLFISH_BOARD.

What is deliberately not here: the signing key. It lives on the container, in a keyring
reprepro owns. publish-packages.yml builds packages from git and attaches them to a
release with checksums, and stops there — putting a signing key into a CI secret is a
decision to take on purpose, not to slip into a workflow. Until then the last step of a
release stays manual.

Also published: scripts/pubblica-sito.py, the website deploy, which existed only as
something to remember. It refuses to upload a build with no CSS — the failure that has
actually happened — never deletes anything on the server, and verifies the live pages
afterwards.

If you want to rebuild the same chain at home, you now can. If you spot something in it that
should not be public, say so here.