Self-host tarballs on asger.weirsoe.dk instead of GitHub Releases

Serve from /srv/tarballz on CT148 via a 'location /tarballz/' alias, NOT
from under /var/www/asger: the asger-web deploy swaps that whole directory
atomically, so tarballs kept inside it would be deleted on the next site
deploy. CT148's rootfs was 3G with 2.7G free - one tarball would have
filled it - so it is grown to 15G; speedy's thin pool has room even though
vgs reports the VG nearly full.

Publishing uploads to a .part name and renames on arrival so a download can
never see a truncated file, verifies sha256 on the host, then fetches the
public URL and checks it against the sha256 baked into the PKGBUILD. Both
checks run before the AUR push, so the package cannot go out pointing at a
missing file. Old tarballs are pruned to the newest three.

GH_TOKEN is kept but demoted to an optional GITHUB_PAT for R module
downloads; it no longer has anything to do with publishing.

.gitea/workflows/build.yml

@@ -24,9 +24,10 @@ concurrency:
   cancel-in-progress: false
 
 env:
-  GH_OWNER: ${{ vars.GH_OWNER }}
-  GH_REPO: ${{ vars.GH_REPO }}
   AUR_MAINTAINER: ${{ vars.AUR_MAINTAINER }}
+  TARBALL_HOST: ${{ vars.TARBALL_HOST }}
+  TARBALL_PATH: ${{ vars.TARBALL_PATH }}
+  TARBALL_BASE_URL: ${{ vars.TARBALL_BASE_URL }}
   WORK_DIR: /srv/jasp-build
 
 jobs:
@@ -95,22 +96,33 @@ jobs:
             --build-info build-info.json \
             --template packaging/PKGBUILD.in \
             --out PKGBUILD \
-            --gh-owner "${GH_OWNER}" \
-            --gh-repo "${GH_REPO}" \
+            --base-url "${TARBALL_BASE_URL}" \
             --maintainer "${AUR_MAINTAINER}"
           cat PKGBUILD
 
-      - name: Publish tarball to GitHub Releases
+      # Must run before the AUR push: the PKGBUILD's sha256sum refers to this
+      # file, so publishing the package before the tarball exists would leave
+      # users with a 404.
+      - name: Publish tarball to asger.weirsoe.dk
         env:
-          GH_TOKEN: ${{ secrets.GH_TOKEN }}
+          TARBALL_SSH_KEY: ${{ secrets.TARBALL_SSH_KEY }}
         run: |
-          TAG="$(python3 -c 'import json;print(json.load(open("release-meta.json"))["tag"])')"
           ASSET="$(python3 -c 'import json;print(json.load(open("release-meta.json"))["tarball"])')"
-          export RELEASE_NOTES="Automated build of JASP ${{ needs.check.outputs.jasp_tag }} for Arch Linux.
-          Consumed by the AUR package jasp-desktop-bin.
-          Trigger: ${{ needs.check.outputs.reasons }}"
-          TAG="$TAG" ASSET="${WORK_DIR}/out/${ASSET}" \
-            bash scripts/publish-github-release.sh
+          bash scripts/publish-tarball.sh "${WORK_DIR}/out/${ASSET}"
+
+      - name: Verify the published URL actually serves the tarball
+        run: |
+          URL="$(python3 -c 'import json;print(json.load(open("release-meta.json"))["download_url"])')"
+          WANT="$(python3 -c 'import json;print(json.load(open("release-meta.json"))["sha256"])')"
+          echo "checking $URL"
+          GOT="$(curl -fsSL --retry 3 "$URL" | sha256sum | awk '{print $1}')"
+          if [ "$GOT" != "$WANT" ]; then
+            echo "error: what the public URL serves does not match the PKGBUILD sha256" >&2
+            echo "  want $WANT" >&2
+            echo "  got  $GOT" >&2
+            exit 1
+          fi
+          echo "public URL serves the expected bytes"
 
       # Only the PKGBUILD and metadata cross the job boundary — the tarball
       # itself already lives on GitHub Releases.