From 64be802667695230e74ac3b2d7d5082fd3261e3a Mon Sep 17 00:00:00 2001 From: ShortArrow Date: Tue, 20 Oct 2026 11:53:53 +0900 Subject: [PATCH] docs(adr): 0052 the registry finds stable releases itself --- docs/adr/0052-apt-repository.md | 16 ++++++++++++++-- 1 file changed, 14 insertions(+), 2 deletions(-) diff --git a/docs/adr/0052-apt-repository.md b/docs/adr/0052-apt-repository.md index 0aebd3c..712e3d6 100644 --- a/docs/adr/0052-apt-repository.md +++ b/docs/adr/0052-apt-repository.md @@ -69,8 +69,18 @@ AUR yet. The `.deb` files are built from the `publish` job's self-contained artifacts before the GitHub Release is created, so they are attached to it and listed in its `SHA256SUMS` with every other asset. The registry -checks each package against that file before indexing it. How a release -starts the registry's publishing run is open in its ADR 0001. +checks each package against that file before indexing it. + +The registry finds the release itself. An hourly workflow there lists +the stable releases of the projects it serves and publishes each new +version, so this repository holds no credential for the registry and +sends it nothing. A token that could notify it would carry write access +to the registry's repository, keyring included. + +Once a version is published, its `.deb` assets are not replaced by +different files under the same names. The registry's index records each +file's size and hash, so `apt` rejects a replaced file until the +registry publishes that version again. ### 4. The install test @@ -109,6 +119,8 @@ publishes. before compression, beside the archives they repeat. - A release that builds a package which does not install stops before anything is published. +- A release reaches APT within about an hour of its GitHub Release, + when the registry's next run finds it. - Reaching APT users depends on the registry's workflow and keys. If either is unavailable, the GitHub Release still ships with its `.deb` files, and the repository lags until the registry's run is repeated.