chore: publish packages to NetBird repositories

.github/workflows/release.yml

@@ -272,3 +272,5 @@ jobs:
           args: release --clean
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          UPLOAD_DEBIAN_SECRET: ${{ secrets.PKG_UPLOAD_SECRET }}
+          UPLOAD_YUM_SECRET: ${{ secrets.PKG_UPLOAD_SECRET }}

.goreleaser.yml

@@ -141,8 +141,13 @@ srpm:
     - docs/reference.md
     - docs/architecture.md
 
+# Two single-format nfpm definitions (instead of one combined deb+rpm entry) so
+# that each artifact carries a distinct id the `uploads` pipe can target. The
+# packages are amd64-only because the bundled GTK/NM editor .so files are built
+# by the C toolchain on the amd64 runner; both entries reference the dedicated
+# amd64-only Go builds for the same reason.
 nfpms:
-  - id: linux-packages
+  - id: linux-packages-deb
     ids:
       - nm-netbird-service-package-amd64
       - nm-netbird-auth-dialog-package-amd64
@@ -157,7 +162,56 @@ nfpms:
     bindir: /usr/libexec
     formats:
       - deb
+    dependencies:
+      - network-manager
+      - netbird
+      - libnm0
+      - libgtk-3-0
+      - libnma0
+      - xdg-utils
+      - libgtk-4-1
+      - libnma-gtk4-0
+    contents:
+      - src: bin/linux_amd64/libnm-vpn-plugin-netbird.so
+        dst: /usr/lib/NetworkManager/libnm-vpn-plugin-netbird.so
+      - src: bin/linux_amd64/libnm-vpn-plugin-netbird-editor.so
+        dst: /usr/lib/NetworkManager/libnm-vpn-plugin-netbird-editor.so
+      - src: bin/linux_amd64/libnm-gtk4-vpn-plugin-netbird-editor.so
+        dst: /usr/lib/NetworkManager/libnm-gtk4-vpn-plugin-netbird-editor.so
+      - src: packaging/NetworkManager/VPN/nm-netbird-service.name
+        dst: /etc/NetworkManager/VPN/nm-netbird-service.name
+      - src: packaging/dbus-1/system.d/nm-netbird-service.conf
+        dst: /usr/share/dbus-1/system.d/nm-netbird-service.conf
+      - src: packaging/NetworkManager/conf.d/90-netbird-unmanaged.conf
+        dst: /etc/NetworkManager/conf.d/90-netbird-unmanaged.conf
+        type: config|noreplace
+      - src: LICENSE
+        dst: /usr/share/doc/network-manager-netbird/LICENSE
+    scripts:
+      postinstall: packaging/scripts/postinstall.sh
+      postremove: packaging/scripts/postremove.sh
+  - id: linux-packages-rpm
+    ids:
+      - nm-netbird-service-package-amd64
+      - nm-netbird-auth-dialog-package-amd64
+    package_name: network-manager-netbird
+    vendor: NetBird
+    homepage: https://netbird.io
+    maintainer: NetBird <hello@netbird.io>
+    description: NetworkManager VPN plugin for NetBird.
+    license: BSD-3-Clause
+    bindir: /usr/libexec
+    formats:
       - rpm
+    dependencies:
+      - NetworkManager
+      - netbird
+      - NetworkManager-libnm
+      - gtk3
+      - libnma
+      - xdg-utils
+      - gtk4
+      - libnma-gtk4
     contents:
       - src: bin/linux_amd64/libnm-vpn-plugin-netbird.so
         dst: /usr/lib/NetworkManager/libnm-vpn-plugin-netbird.so
@@ -174,33 +228,39 @@ nfpms:
         type: config|noreplace
       - src: packaging/selinux/nm_netbird.pp
         dst: /usr/share/selinux/packages/nm_netbird.pp
-        packager: rpm
       - src: LICENSE
         dst: /usr/share/doc/network-manager-netbird/LICENSE
     scripts:
       postinstall: packaging/scripts/postinstall.sh
       postremove: packaging/scripts/postremove.sh
-    overrides:
-      deb:
-        dependencies:
-          - network-manager
-          - netbird
-          - libnm0
-          - libgtk-3-0
-          - libnma0
-          - xdg-utils
-          - libgtk-4-1
-          - libnma-gtk4-0
-      rpm:
-        dependencies:
-          - NetworkManager
-          - netbird
-          - NetworkManager-libnm
-          - gtk3
-          - libnma
-          - xdg-utils
-          - gtk4
-          - libnma-gtk4
+
+# Publish the freshly built packages to the NetBird apt/yum repositories. These
+# run in the publish phase, so they are skipped automatically for snapshot builds
+# (which pass --skip=publish) and only fire on tagged releases. The legacy
+# wiretrustee.com hostname is the authenticated upload endpoint; users access the
+# same repositories through the canonical pkgs.netbird.io hostname documented in
+# the README. Authentication uses the UPLOAD_DEBIAN_SECRET / UPLOAD_YUM_SECRET
+# env vars (set in CI).
+uploads:
+  - name: debian
+    ids:
+      - linux-packages-deb
+    exts:
+      - deb
+    mode: archive
+    target: https://pkgs.wiretrustee.com/debian/pool/{{ .ArtifactName }};deb.distribution=stable;deb.component=main;deb.architecture=amd64;deb.package=
+    custom_artifact_name: true
+    username: dev@wiretrustee.com
+    method: PUT
+  - name: yum
+    ids:
+      - linux-packages-rpm
+    exts:
+      - rpm
+    mode: archive
+    target: https://pkgs.wiretrustee.com/yum/amd64
+    username: dev@wiretrustee.com
+    method: PUT
 
 checksum:
   name_template: checksums.txt

README.md

@@ -7,8 +7,9 @@ NetworkManager is only a control/status frontend in this integration. NetBird re
 ## Requirements
 
 - Linux with NetworkManager
-- NetBird daemon/runtime installed (see the [official NetBird Linux installation guide](https://docs.netbird.io/get-started/install/linux))
+- NetBird daemon/runtime installed or installable from the NetBird package repository (see the [official NetBird Linux installation guide](https://docs.netbird.io/get-started/install/linux))
 - NetBird daemon gRPC socket available (default: `unix:///var/run/netbird.sock`)
+
 When building the desktop properties editor from source:
 
 - `cc`, `pkg-config`, libnm, GTK 3, and libnma development headers
@@ -23,53 +24,67 @@ When building the desktop properties editor from source:
 
 ## Quick install
 
-### One-line quickstart
+Tagged releases are published to the NetBird APT/YUM repositories as `network-manager-netbird` for `amd64`/`x86_64`. The package depends on the NetBird daemon/runtime package (`netbird`), so package managers can install both from the same repository. You still need to authenticate/connect NetBird after installation.
 
-For Ubuntu/Debian/Fedora/RHEL on `amd64`/`x86_64`, the quickstart script installs NetworkManager prerequisites, enables NetworkManager, downloads the latest package, and installs it. The NetBird daemon/runtime requirement above still applies:
+### Ubuntu/Debian (APT)
 
 ```bash
-curl -fsSL https://raw.githubusercontent.com/netbirdio/network-manager-vpn-plugin/main/scripts/quickstart.sh | sh
+sudo apt-get update
+sudo apt-get install -y ca-certificates curl gnupg network-manager
+
+curl -fsSL https://pkgs.netbird.io/debian/public.key \
+  | sudo gpg --dearmor --yes -o /usr/share/keyrings/netbird-archive-keyring.gpg
+sudo chmod 0644 /usr/share/keyrings/netbird-archive-keyring.gpg
+
+echo 'deb [signed-by=/usr/share/keyrings/netbird-archive-keyring.gpg] https://pkgs.netbird.io/debian stable main' \
+  | sudo tee /etc/apt/sources.list.d/netbird.list
+
+sudo apt-get update
+sudo apt-get install -y network-manager-netbird
+sudo systemctl enable --now NetworkManager
 ```
 
-To review it before running:
+### Fedora/RHEL (DNF/YUM)
 
 ```bash
-curl -fsSLO https://raw.githubusercontent.com/netbirdio/network-manager-vpn-plugin/main/scripts/quickstart.sh
-less quickstart.sh
-sh quickstart.sh
+sudo dnf install -y NetworkManager curl ca-certificates
+
+sudo tee /etc/yum.repos.d/netbird.repo >/dev/null <<'EOF'
+[NetBird]
+name=NetBird
+baseurl=https://pkgs.netbird.io/yum/
+enabled=1
+gpgcheck=1
+gpgkey=https://pkgs.netbird.io/yum/repodata/repomd.xml.key
+repo_gpgcheck=1
+EOF
+
+sudo dnf install -y network-manager-netbird
+sudo systemctl enable --now NetworkManager
 ```
 
-For snapshot releases:
+Replace `dnf` with `yum` on systems that do not provide `dnf`.
+
+### One-line quickstart and snapshots
+
+For Ubuntu/Debian/Fedora/RHEL on `amd64`/`x86_64`, the quickstart script installs NetworkManager prerequisites, enables NetworkManager, downloads a package from the GitHub release assets, and installs it:
 
 ```bash
-curl -fsSL https://raw.githubusercontent.com/netbirdio/network-manager-vpn-plugin/main/scripts/quickstart.sh | env RELEASE_TAG=snapshot sh
+curl -fsSL https://raw.githubusercontent.com/netbirdio/network-manager-vpn-plugin/main/scripts/quickstart.sh | sh
 ```
 
-### Ubuntu/Debian
+To review it before running:
 
 ```bash
-sudo apt update
-sudo apt install network-manager curl
-sudo systemctl enable --now NetworkManager
-
-curl -fL -o network-manager-netbird_linux_amd64.deb "$(curl -fsSL https://api.github.com/repos/netbirdio/network-manager-vpn-plugin/releases/latest | grep '"browser_download_url":' | grep -E 'network-manager-netbird.*(_linux_amd64|_amd64|\.x86_64)\.deb"' | cut -d '"' -f 4 | head -n 1)"
-sudo apt install ./network-manager-netbird_linux_amd64.deb
+curl -fsSLO https://raw.githubusercontent.com/netbirdio/network-manager-vpn-plugin/main/scripts/quickstart.sh
+less quickstart.sh
+sh quickstart.sh
 ```
 
-### Fedora/RHEL
+Snapshot releases are not published to the package repositories. To install the latest snapshot package from GitHub release assets:
 
 ```bash
-sudo dnf install NetworkManager curl
-sudo systemctl enable --now NetworkManager
-
-RELEASE_API=https://api.github.com/repos/netbirdio/network-manager-vpn-plugin/releases/latest
-asset_url="$(curl -fsSL "$RELEASE_API" |
-  grep '"browser_download_url":' |
-  grep -E 'network-manager-netbird.*(_linux_amd64|_amd64|\.x86_64)\.rpm"' |
-  cut -d '"' -f 4 |
-  head -n 1)"
-curl -fL -o network-manager-netbird_linux_amd64.rpm "$asset_url"
-sudo dnf install ./network-manager-netbird_linux_amd64.rpm
+curl -fsSL https://raw.githubusercontent.com/netbirdio/network-manager-vpn-plugin/main/scripts/quickstart.sh | env RELEASE_TAG=snapshot sh
 ```
 
 ### Other distributions (tarball)
@@ -83,7 +98,7 @@ sudo ./install.sh
 
 Substitute `amd64` with `arm64` or `armv7` as needed.
 
-For snapshot releases, use `RELEASE_TAG=snapshot` with the quickstart script, set `RELEASE_API=https://api.github.com/repos/netbirdio/network-manager-vpn-plugin/releases/tags/snapshot` in the package examples, or replace `latest/download` with `download/snapshot` in the tarball URL.
+For snapshot releases, use `RELEASE_TAG=snapshot` with the quickstart script, or replace `latest/download` with `download/snapshot` in the tarball URL.
 
 ### Verify
 
@@ -173,13 +188,13 @@ See the [Architecture](docs/architecture.md#activation-lifecycle) doc for the ac
 ## Upgrade and uninstall
 
 ```bash
-# Upgrade a package install: download the newer .deb/.rpm and install it the same way.
-sudo apt install ./network-manager-netbird_linux_amd64.deb   # Debian
-sudo dnf install ./network-manager-netbird_linux_amd64.rpm   # Fedora
+# Upgrade a package-repository install
+sudo apt-get update && sudo apt-get install -y --only-upgrade network-manager-netbird   # Ubuntu/Debian
+sudo dnf upgrade -y network-manager-netbird                                      # Fedora/RHEL
 
 # Uninstall
-sudo apt remove network-manager-netbird   # Ubuntu/Debian
-sudo dnf remove network-manager-netbird   # Fedora/RHEL
+sudo apt-get remove network-manager-netbird   # Ubuntu/Debian
+sudo dnf remove network-manager-netbird       # Fedora/RHEL
 ```
 
 For tarball installs, run the bundled `uninstall.sh`.

docs/reference.md

@@ -183,7 +183,7 @@ The plugin communicates with the local NetBird daemon over gRPC at the configure
 
 ## Installed files
 
-Package installs (`.deb`, `.rpm`) place files at the following paths. Tarball installs use the same layout for binaries, NetworkManager metadata, editor modules, and unmanaged-interface config by default, with overrides available through `DESTDIR`, `LIBEXEC_DIR`, `NM_PLUGIN_DIR`, `NM_VPN_DIR`, `DBUS_POLICY_DIR`, and `NM_CONF_DIR`.
+Package installs (`network-manager-netbird` from the NetBird APT/YUM repositories, or a local `.deb`/`.rpm`) place files at the following paths. Tarball installs use the same layout for binaries, NetworkManager metadata, editor modules, and unmanaged-interface config by default, with overrides available through `DESTDIR`, `LIBEXEC_DIR`, `NM_PLUGIN_DIR`, `NM_VPN_DIR`, `DBUS_POLICY_DIR`, and `NM_CONF_DIR`.
 
 | Path | Purpose |
 | --- | --- |