Answer architecture round 2: 1 🔴, 0 🟡; self-host signed apt, dnf and apk repositories on GitHub Pages in place of Cloudsmith, and keep an older tag's image while leaving latest alone

release-tooling/goreleaser.yaml

@@ -58,7 +58,7 @@ dockers_v2:
       - ghcr.io/larvit/fejkdata
     tags:
       - "{{ .Version }}"
-      - latest
+      - '{{ if not (isEnvSet "OLDER_TAG") }}latest{{ end }}'
     dockerfile: ../tooling/release-tooling/image.Dockerfile
     labels:
       org.opencontainers.image.source: *homepage

release-tooling/package-repos.Dockerfile

@@ -0,0 +1,82 @@
+# The apt, dnf and apk repositories GitHub Pages serves, signed, from the .deb, .rpm and
+# .apk files in the build context. The checks target installs fejkdata from each:
+#
+#   docker build -f package-repos.Dockerfile --secret id=gpg,env=PACKAGES_GPG_KEY \
+#     --secret id=rsa,env=PACKAGES_RSA_KEY --target checks <dir>
+#   docker build ... --target site --output <site dir> <dir>
+ARG BASE_URL=https://larvit.github.io/fejkdata
+
+FROM debian:trixie-20260918-slim AS deb-rpm
+ARG BASE_URL
+RUN apt-get update && apt-get install -y --no-install-recommends apt-utils createrepo-c dpkg-dev gnupg \
+	&& rm -rf /var/lib/apt/lists/*
+COPY *.deb /site/deb/pool/
+COPY *.rpm /site/rpm/
+WORKDIR /site
+RUN --mount=type=secret,id=gpg,required=true \
+	gpg --batch --quiet --import /run/secrets/gpg \
+	&& gpg --armor --export > fejkdata.asc \
+	&& cd deb \
+	&& for arch in amd64 arm64; do \
+		mkdir -p dists/stable/main/binary-$arch \
+		&& dpkg-scanpackages --arch $arch pool > dists/stable/main/binary-$arch/Packages \
+		&& gzip -9k dists/stable/main/binary-$arch/Packages; \
+	done \
+	&& apt-ftparchive -o APT::FTPArchive::Release::Origin=fejkdata \
+		-o APT::FTPArchive::Release::Suite=stable -o APT::FTPArchive::Release::Codename=stable \
+		-o APT::FTPArchive::Release::Components=main \
+		-o "APT::FTPArchive::Release::Architectures=amd64 arm64" \
+		release dists/stable > dists/stable/Release \
+	&& gpg --batch --yes --clearsign -o dists/stable/InRelease dists/stable/Release \
+	&& gpg --batch --yes --armor --detach-sign -o dists/stable/Release.gpg dists/stable/Release \
+	&& cd ../rpm \
+	&& createrepo_c --quiet . \
+	&& gpg --batch --yes --armor --detach-sign repodata/repomd.xml \
+	&& printf '[fejkdata]\nname=fejkdata\nbaseurl=%s/rpm\nrepo_gpgcheck=1\ngpgcheck=0\ngpgkey=%s/fejkdata.asc\n' \
+		"$BASE_URL" "$BASE_URL" > fejkdata.repo
+
+FROM alpine:3.22.2 AS apk
+RUN apk add --no-cache abuild openssl
+COPY *.apk /packages/
+RUN --mount=type=secret,id=rsa,required=true \
+	mkdir -p /keys /site/apk/x86_64 /site/apk/aarch64 \
+	&& cp /run/secrets/rsa /keys/fejkdata.rsa \
+	&& openssl rsa -in /keys/fejkdata.rsa -pubout -out /keys/fejkdata.rsa.pub 2>/dev/null \
+	&& cp /keys/fejkdata.rsa.pub /site/apk/ \
+	&& cp /packages/*_linux_amd64.apk /site/apk/x86_64/ \
+	&& cp /packages/*_linux_arm64.apk /site/apk/aarch64/ \
+	&& for arch in x86_64 aarch64; do \
+		cd /site/apk/$arch \
+		&& apk index --quiet --allow-untrusted -o APKINDEX.tar.gz *.apk \
+		&& mv *.apk "fejkdata-$(tar -xzOf APKINDEX.tar.gz APKINDEX | sed -n 's/^V://p').apk" \
+		&& abuild-sign -q -k /keys/fejkdata.rsa APKINDEX.tar.gz; \
+	done
+
+FROM scratch AS site
+COPY --from=deb-rpm /site /
+COPY --from=apk /site /
+
+FROM debian:trixie-20260918-slim AS check-deb
+COPY --from=site / /site
+RUN echo 'deb [signed-by=/site/fejkdata.asc] file:/site/deb stable main' > /etc/apt/sources.list.d/fejkdata.list \
+	&& apt-get update -o Dir::Etc::SourceList=/etc/apt/sources.list.d/fejkdata.list -o Dir::Etc::SourceParts=- \
+	&& apt-get install -y fejkdata \
+	&& fejkdata --version > /checked
+
+FROM fedora:43@sha256:a651ddf48ea28a06ed4e1e6519f51c9f47e7a5a138722ade87369b8fbb7e5b42 AS check-rpm
+COPY --from=site / /site
+RUN sed -e 's#^baseurl=.*#baseurl=file:///site/rpm#' -e 's#^gpgkey=.*#gpgkey=file:///site/fejkdata.asc#' \
+		/site/rpm/fejkdata.repo > /etc/yum.repos.d/fejkdata.repo \
+	&& dnf install -y --repo fejkdata fejkdata \
+	&& fejkdata --version > /checked
+
+FROM alpine:3.22.2 AS check-apk
+COPY --from=site / /site
+RUN cp /site/apk/fejkdata.rsa.pub /etc/apk/keys/ \
+	&& apk add --no-cache --repositories-file /dev/null -X /site/apk fejkdata \
+	&& fejkdata --version > /checked
+
+FROM scratch AS checks
+COPY --from=check-deb /checked /deb
+COPY --from=check-rpm /checked /rpm
+COPY --from=check-apk /checked /apk