Merge nucleic/olive-ember-seal-q7vk into dev

repo/r2-sync.sh

@@ -0,0 +1,22 @@
+#!/usr/bin/env bash
+# Sync the published apt tree to Cloudflare R2 (served as apt.naros.dev; NAROS.md §3.2).
+# Uses rclone's S3 backend with env-provided credentials (CI secrets):
+#   R2_ACCOUNT_ID, R2_ACCESS_KEY_ID, R2_SECRET_ACCESS_KEY, R2_BUCKET (default naros-apt)
+set -euo pipefail
+
+OS_DIR="$(cd "$(dirname "$0")/.." && pwd)"
+REPO="$OS_DIR/dist/repo"
+: "${R2_ACCOUNT_ID:?}" "${R2_ACCESS_KEY_ID:?}" "${R2_SECRET_ACCESS_KEY:?}"
+BUCKET="${R2_BUCKET:-naros-apt}"
+[ -d "$REPO" ] || { echo "no repo at $REPO — run repo/publish.sh first" >&2; exit 2; }
+
+export RCLONE_CONFIG_R2_TYPE=s3 \
+       RCLONE_CONFIG_R2_PROVIDER=Cloudflare \
+       RCLONE_CONFIG_R2_ACCESS_KEY_ID="$R2_ACCESS_KEY_ID" \
+       RCLONE_CONFIG_R2_SECRET_ACCESS_KEY="$R2_SECRET_ACCESS_KEY" \
+       RCLONE_CONFIG_R2_ENDPOINT="https://${R2_ACCOUNT_ID}.r2.cloudflarestorage.com"
+
+# pool/ first, dists/ last: clients never see an index referencing a not-yet-uploaded deb.
+rclone copy "$REPO/pool" "r2:$BUCKET/pool" --checksum
+rclone sync "$REPO/dists" "r2:$BUCKET/dists" --checksum
+echo "synced $REPO -> r2:$BUCKET"