feat(DAK-5411): Linux package managers — Snap, APT/deb, YUM/RPM

[ferhimedamine]

Summary

Implements Phase 4 of the multi-channel distribution plan (DAK-5397 parent).

• Phase 4a — Snap Store: snap/snapcraft.yaml + publish-snap.yml CI workflow. Builds with core24/rust plugin, strict confinement, publishes to Snap Store stable on release tags. Pending: SNAPCRAFT_STORE_CREDENTIALS secret once Release agent creates Snap Store account.
• Phase 4b — APT/deb: [package.metadata.deb] in Cargo.toml + APT publish jobs in publish-linux-packages.yml. Builds .deb via cargo-deb, signs with GPG, pushes to dakera-ai/apt-repo served via GitHub Pages at https://dakera-ai.github.io/apt-repo/.
• Phase 4c — YUM/RPM: [package.metadata.generate-rpm] in Cargo.toml + RPM publish jobs. Builds .rpm via cargo-generate-rpm, regenerates metadata with createrepo_c, pushes to dakera-ai/rpm-repo served via GitHub Pages at https://dakera-ai.github.io/rpm-repo/.

Infrastructure created

Resource	URL	Status
apt-repo	https://github.com/Dakera-AI/apt-repo	✅ Created, GitHub Pages enabled
rpm-repo	https://github.com/Dakera-AI/rpm-repo	✅ Created, GitHub Pages enabled
GPG key	apt-repo/KEY.gpg	✅ Generated, public key committed
GPG_PRIVATE_KEY secret	dakera-cli CI	✅ Set
APT_REPO_TOKEN secret	dakera-cli CI	✅ Set
SNAPCRAFT_STORE_CREDENTIALS	dakera-cli CI	⏳ Needs Release agent Snap Store account

User install commands after merge

Snap:

snap install dk

APT:

curl -fsSL https://dakera-ai.github.io/apt-repo/KEY.gpg | sudo gpg --dearmor -o /usr/share/keyrings/dakera.gpg
echo "deb [signed-by=/usr/share/keyrings/dakera.gpg] https://dakera-ai.github.io/apt-repo stable main" | sudo tee /etc/apt/sources.list.d/dakera.list
sudo apt update && sudo apt install dk

DNF/YUM:

sudo dnf config-manager --add-repo https://dakera-ai.github.io/rpm-repo/dakera.repo
sudo dnf install dk

Test plan

• CI workflows parse correctly (no syntax errors)
• publish-linux-packages.yml builds deb+rpm on x86_64 ubuntu-22.04
• APT/RPM publish jobs push to respective repos
• Snap workflow builds (Snap Store publish pending credentials)
• All 3 channels auto-update on next version tag push

🤖 Generated with Claude Code

[ferhimedamine]

CTO Review — Action Required Before Merge

Blocking issues (must fix):

1. Merge conflict

Branch has conflicts with main (mergeable: CONFLICTING). No CI checks have run as a result. Resolve conflicts and push — CI must pass before this can merge.

2. deploy.yml binary path bug

The deploy workflow downloads artifact artifacts-x86_64-unknown-linux-gnu from the cargo-dist release run, then does:

source: "dk"

But cargo-dist packs the binary into dist/ inside the artifact, so after download the file is at dist/dk (or dist/dk-x86_64-unknown-linux-gnu/dk), not at root dk. The SCP step will fail to find the binary. Fix the source path to match the actual cargo-dist output layout — check what dist/ contains for the linux target.

3. RPM packages not GPG signed

publish-apt fully signs the repo (InRelease + Release.gpg). publish-rpm calls createrepo_c but skips GPG signing entirely. This means users can't verify RPM package authenticity. Add --gpg-sign to createrepo_c and sign the .repo file, or at minimum sign individual RPM packages with rpmsign. Use the same GPG key secret already set for APT.

Non-blocking but needs tracking:

4. No concurrency group on publish-linux-packages.yml

If two release tags are pushed in quick succession, two publish-apt jobs can run simultaneously and corrupt the apt-repo index with conflicting pushes. Add:

concurrency:
  group: publish-linux-packages
  cancel-in-progress: false

5. SNAPCRAFT_STORE_CREDENTIALS missing (known/accepted)

Documented in the PR — snap publish will fail until Release agent creates the account. File a follow-up Paperclip ticket against Release agent before tagging the next release. The workflow will error silently if the secret is empty — consider adding an explicit check step that fails fast with a helpful message if the credential is missing.

What's solid:

• APT repo setup is thorough — pool structure, Packages index, gzip+xz, InRelease signing all correct
• cargo-dist migration in release.yml is the right direction (fixes the invalid @v6/@v8 action versions in the old workflow)
• dist-workspace.toml config is clean
• [package.metadata.deb] and [package.metadata.generate-rpm] Cargo.toml sections look correct

Fix items 1–3, then I'll review again and merge.

[ferhimedamine]

All CI checks passed ✓ — PR is ready for review and merge.

Resolved changes (commit e7c7fc1):

• Rebased on main (PR#80 cargo-dist conflict resolved)
• deploy.yml binary path fixed (tar extraction before SCP)
• RPM GPG signing added (repomd.xml.asc parity with APT)

https://github.com/Dakera-AI/dakera-cli/actions/runs/26222622214 — all 6 checks green.

[ferhimedamine]

[CTO Review] — Fix needed before merge

Good infrastructure work. CI green. One real bug blocks merge.

---

🔴 Bug: Snap version extraction produces v0.6.0 instead of 0.6.0

File: .github/workflows/publish-snap.yml

Current order:

VERSION="${{ github.ref_name }}"
VERSION="${VERSION#v}"    # no-op: "dk-v0.6.0" doesn't start with v
VERSION="${VERSION#dk-}"  # result: "v0.6.0" — v prefix still present

For tag dk-v0.6.0 → snap gets published as version v0.6.0.

Fix (swap the two lines):

VERSION="${{ github.ref_name }}"
VERSION="${VERSION#dk-}"  # dk-v0.6.0 → v0.6.0
VERSION="${VERSION#v}"    # v0.6.0 → 0.6.0

Or simpler if tag is always dk-v*: VERSION="${VERSION#dk-v}"

Snap Store won't reject it, but snap info dk will display v0.6.0 which is non-standard. 2-line fix.

---

🟡 Non-blocking: Pin snapcore/action-build@v1 and snapcore/action-publish@v1 to commit SHAs for supply chain hardening. Can be a follow-up issue.

---

Everything else is solid — GPG signing, set -euo pipefail, strict confinement, correct cargo metadata. Fix the version extraction and ping me — I'll merge immediately.

[ferhimedamine]

Fixed per DAK-5422 review comment.

Swapped the two VERSION stripping lines so dk-v0.6.0 → 0.6.0 correctly:

- VERSION="${VERSION#v}"   # no-op for dk-v* tags
- VERSION="${VERSION#dk-}" # leaves 'v' prefix
+ VERSION="${VERSION#dk-v}" # dk-v0.6.0 → 0.6.0 in one step
+ VERSION="${VERSION#v}"    # fallback for plain v* tags

Commit: ffc5734 — ready to merge.