From 3a75aea2b4186cb6f20355f6496ebbf85f409356 Mon Sep 17 00:00:00 2001
From: Ge Yao <my@yaoge123.com>
Date: Sun, 24 May 2026 17:20:04 +0800
Subject: [PATCH 1/4] Add qgis-deb.sh to mirror QGIS apt repositories

Drives apt-sync.py against five sibling apt repos hosted under
qgis.org: debian, debian-ltr, ubuntu, ubuntugis, ubuntugis-ltr.
ubuntu-ltr is a symlink to debian-ltr (upstream serves identical
content under both names).

Codename and architecture lists are kept in sync with what QGIS
publishes today (Debian bullseye/bookworm/trixie + Ubuntu jammy/
noble/resolute/plucky/questing/focal/xenial/bionic for the deb
flavour, jammy/noble/bionic/focal/xenial for the ubuntugis flavour).
---
 qgis-deb.sh | 37 +++++++++++++++++++++++++++++++++++++
 1 file changed, 37 insertions(+)
 create mode 100755 qgis-deb.sh

diff --git a/qgis-deb.sh b/qgis-deb.sh
new file mode 100755
index 0000000..45cf5f7
--- /dev/null
+++ b/qgis-deb.sh
@@ -0,0 +1,37 @@
+#!/bin/bash
+set -e
+set -o pipefail
+
+_here=$(dirname "$(realpath "$0")")
+apt_sync="/home/tunasync-scripts/apt-sync.py"
+
+BASE_URL="${TUNASYNC_UPSTREAM_URL:-"https://qgis.org"}"
+WORKDIR="${TUNASYNC_WORKING_DIR}"
+export REPO_SIZE_FILE="/tmp/reposize.$RANDOM"
+
+DEB_CODENAMES="bullseye,bookworm,trixie,jammy,noble,resolute,plucky,questing,focal,xenial,bionic"
+DEB_ARCHES="amd64,i386"
+
+UBUNTUGIS_CODENAMES="jammy,noble,bionic,focal,xenial"
+UBUNTUGIS_ARCHES="amd64"
+
+"$apt_sync" --delete "${BASE_URL}/debian"      "$DEB_CODENAMES"     main "$DEB_ARCHES"      "${WORKDIR}/debian"
+echo "debian finished"
+
+"$apt_sync" --delete "${BASE_URL}/debian-ltr"  "$DEB_CODENAMES"     main "$DEB_ARCHES"      "${WORKDIR}/debian-ltr"
+echo "debian-ltr finished"
+
+"$apt_sync" --delete "${BASE_URL}/ubuntu"      "$DEB_CODENAMES"     main "$DEB_ARCHES"      "${WORKDIR}/ubuntu"
+echo "ubuntu finished"
+
+"$apt_sync" --delete "${BASE_URL}/ubuntugis"   "$UBUNTUGIS_CODENAMES" main "$UBUNTUGIS_ARCHES" "${WORKDIR}/ubuntugis"
+echo "ubuntugis finished"
+
+"$apt_sync" --delete "${BASE_URL}/ubuntugis-ltr" "$UBUNTUGIS_CODENAMES" main "$UBUNTUGIS_ARCHES" "${WORKDIR}/ubuntugis-ltr"
+echo "ubuntugis-ltr finished"
+
+# ubuntu-ltr is a symlink to debian-ltr (identical content)
+ln -sfn debian-ltr "${WORKDIR}/ubuntu-ltr"
+echo "ubuntu-ltr symlink created"
+
+"/home/tunasync-scripts/helpers/size-sum.sh" "$REPO_SIZE_FILE" --rm || true

From 63a9de61bf27aa6637d21a566766641d4c7c623c Mon Sep 17 00:00:00 2001
From: Ge Yao <my@yaoge123.com>
Date: Sun, 24 May 2026 17:37:25 +0800
Subject: [PATCH 2/4] qgis-deb.sh: use _here-relative paths for apt-sync.py and
 size-sum.sh

Follow the convention used by chef.sh/cvmfs.sh/bazel-apt.sh: locate
helper scripts relative to the script directory (${_here}/apt-sync.py
and ${_here}/helpers/size-sum.sh) instead of hard-coded
/home/tunasync-scripts/* paths.
---
 qgis-deb.sh | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/qgis-deb.sh b/qgis-deb.sh
index 45cf5f7..9e0e4ee 100755
--- a/qgis-deb.sh
+++ b/qgis-deb.sh
@@ -3,7 +3,7 @@ set -e
 set -o pipefail
 
 _here=$(dirname "$(realpath "$0")")
-apt_sync="/home/tunasync-scripts/apt-sync.py"
+apt_sync="${_here}/apt-sync.py"
 
 BASE_URL="${TUNASYNC_UPSTREAM_URL:-"https://qgis.org"}"
 WORKDIR="${TUNASYNC_WORKING_DIR}"
@@ -34,4 +34,4 @@ echo "ubuntugis-ltr finished"
 ln -sfn debian-ltr "${WORKDIR}/ubuntu-ltr"
 echo "ubuntu-ltr symlink created"
 
-"/home/tunasync-scripts/helpers/size-sum.sh" "$REPO_SIZE_FILE" --rm || true
+"${_here}/helpers/size-sum.sh" "$REPO_SIZE_FILE" --rm || true

From b39a677cba0c2699b2f5e142195da500b87fbdd7 Mon Sep 17 00:00:00 2001
From: Ge Yao <my@yaoge123.com>
Date: Sun, 24 May 2026 17:41:47 +0800
Subject: [PATCH 3/4] qgis-deb.sh: use mktemp for REPO_SIZE_FILE and surface
 size-sum.sh errors

- Switch /tmp/reposize.$RANDOM to mktemp + trap rm cleanup, avoiding
  predictable filename collisions and symlink attacks.
- Replace 'size-sum.sh ... || true' with explicit error logging so
  size reporting failures are visible instead of silently swallowed.
---
 qgis-deb.sh | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/qgis-deb.sh b/qgis-deb.sh
index 9e0e4ee..171698f 100755
--- a/qgis-deb.sh
+++ b/qgis-deb.sh
@@ -7,7 +7,10 @@ apt_sync="${_here}/apt-sync.py"
 
 BASE_URL="${TUNASYNC_UPSTREAM_URL:-"https://qgis.org"}"
 WORKDIR="${TUNASYNC_WORKING_DIR}"
-export REPO_SIZE_FILE="/tmp/reposize.$RANDOM"
+
+REPO_SIZE_FILE=$(mktemp -t qgis-deb-reposize.XXXXXX)
+export REPO_SIZE_FILE
+trap 'rm -f "$REPO_SIZE_FILE"' EXIT
 
 DEB_CODENAMES="bullseye,bookworm,trixie,jammy,noble,resolute,plucky,questing,focal,xenial,bionic"
 DEB_ARCHES="amd64,i386"
@@ -34,4 +37,6 @@ echo "ubuntugis-ltr finished"
 ln -sfn debian-ltr "${WORKDIR}/ubuntu-ltr"
 echo "ubuntu-ltr symlink created"
 
-"${_here}/helpers/size-sum.sh" "$REPO_SIZE_FILE" --rm || true
+if ! "${_here}/helpers/size-sum.sh" "$REPO_SIZE_FILE" --rm; then
+    echo "warning: size-sum.sh failed, continuing" >&2
+fi

From f6fed2ccf695c33e5ef3f8b341f20ffbbe73dd56 Mon Sep 17 00:00:00 2001
From: Ge Yao <my@yaoge123.com>
Date: Sun, 24 May 2026 20:00:54 +0800
Subject: [PATCH 4/4] qgis-deb.sh: align size-sum.sh invocation with repo
 convention

Per Copilot review reflection: chef.sh, cvmfs.sh, bazel-apt.sh, termux.sh
all call size-sum.sh directly without if/warning wrapping. Removing the
guard for consistency. With set -e the script will still surface any
size-sum.sh failure, but at this point all apt-sync runs have already
completed, matching the repo's existing posture.
---
 qgis-deb.sh | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/qgis-deb.sh b/qgis-deb.sh
index 171698f..50e97d8 100755
--- a/qgis-deb.sh
+++ b/qgis-deb.sh
@@ -37,6 +37,4 @@ echo "ubuntugis-ltr finished"
 ln -sfn debian-ltr "${WORKDIR}/ubuntu-ltr"
 echo "ubuntu-ltr symlink created"
 
-if ! "${_here}/helpers/size-sum.sh" "$REPO_SIZE_FILE" --rm; then
-    echo "warning: size-sum.sh failed, continuing" >&2
-fi
+"${_here}/helpers/size-sum.sh" "$REPO_SIZE_FILE" --rm