docs: versioned CDN downloads + add CDN upload script

Co-authored-by: arena-agent <297053741+arena-agent@users.noreply.github.com>

README.md

@@ -21,9 +21,9 @@ Lightning infrastructure, private cloud, and communications platform when you
 are ready.
 
 [Visit the Website](https://sovransystems.com) ·
-[Download the ISO](https://downloads.sovransystems.com/Sovran_SystemsOS-1.0.3.iso) ·
+[Download the ISO](https://downloads.sovransystems.com/Sovran_SystemsOS-1.0.5.iso) ·
 [Try it safely in a VM](#try-it-first-in-a-virtual-machine) ·
-[Verify the Download](https://downloads.sovransystems.com/Sovran_SystemsOS.iso.sha256) ·
+[Verify the Download](https://downloads.sovransystems.com/Sovran_SystemsOS-1.0.5.iso.sha256) ·
 [Build from Source](#build-from-source)
 
 <img src="assets/desktop-screenshot.png" alt="Sovran_SystemsOS private Bitcoin desktop" width="800" />
@@ -50,6 +50,7 @@ are ready.
 - [For developers](#for-developers)
   - [Development workflow](#development-workflow)
   - [Build from source](#build-from-source)
+  - [Publishing a release](#publishing-a-release)
 - [About Bitcoin wallet entropy](#about-bitcoin-wallet-entropy)
 - [Security approach](#security-approach)
 - [Acknowledgements](#acknowledgements)
@@ -341,8 +342,8 @@ with an imaging application such as [Balena Etcher](https://etcher.balena.io).
 
 ### 1. Download the ISO and checksum
 
-- [Download Sovran_SystemsOS.iso](https://downloads.sovransystems.com/Sovran_SystemsOS.iso)
+- [Download Sovran_SystemsOS-1.0.5.iso](https://downloads.sovransystems.com/Sovran_SystemsOS-1.0.5.iso)
-- [Download Sovran_SystemsOS.iso.sha256](https://downloads.sovransystems.com/Sovran_SystemsOS.iso.sha256)
+- [Download Sovran_SystemsOS-1.0.5.iso.sha256](https://downloads.sovransystems.com/Sovran_SystemsOS-1.0.5.iso.sha256)
 
 The download may take some time. Do not rename or modify the ISO before
 verifying it, and keep both files in the same folder.
@@ -360,16 +361,16 @@ checksum exactly.
 Open a terminal in the download folder and run:
 
 ```bash
-sha256sum --check Sovran_SystemsOS.iso.sha256
+sha256sum --check Sovran_SystemsOS-1.0.5.iso.sha256
 ```
 
 A successful comparison reports:
 
 ```text
-Sovran_SystemsOS.iso: OK
+Sovran_SystemsOS-1.0.5.iso: OK
 ```
 
-You can also run `sha256sum Sovran_SystemsOS.iso` and compare the output
+You can also run `sha256sum Sovran_SystemsOS-1.0.5.iso` and compare the output
 against the checksum file manually.
 
 </details>
@@ -380,11 +381,11 @@ against the checksum file manually.
 Open Terminal in the download folder and run:
 
 ```bash
-shasum -a 256 Sovran_SystemsOS.iso
+shasum -a 256 Sovran_SystemsOS-1.0.5.iso
 ```
 
 Compare the value shown in Terminal with the value inside
-`Sovran_SystemsOS.iso.sha256`.
+`Sovran_SystemsOS-1.0.5.iso.sha256`.
 
 </details>
 
@@ -394,7 +395,7 @@ Compare the value shown in Terminal with the value inside
 Open PowerShell in the download folder and run:
 
 ```powershell
-Get-FileHash .\Sovran_SystemsOS.iso -Algorithm SHA256
+Get-FileHash .\Sovran_SystemsOS-1.0.5.iso -Algorithm SHA256
 ```
 
 Compare the value under `Hash` with the published checksum.
@@ -409,7 +410,7 @@ match exactly.
 
 1. Download and install [Balena Etcher](https://etcher.balena.io), then
    connect the USB drive.
-2. Choose **Flash from file** and select `Sovran_SystemsOS.iso`.
+2. Choose **Flash from file** and select `Sovran_SystemsOS-1.0.5.iso`.
 3. Choose **Select target**, select the USB drive, and review your selection
    carefully.
 4. Choose **Flash** and wait for the writing and verification process to
@@ -572,6 +573,23 @@ nix build \
 
 The resulting build output will be available through the `result` symlink.
 
+### Publishing a release
+
+Releases are managed with `scripts/release-stable.sh` and `scripts/upload-cdn.sh`:
+
+1. Run the stable release script to bump version, tag, update changelog, and push/create releases:
+   ```bash
+   ./scripts/release-stable.sh [version]
+   ```
+2. Build the installer ISO:
+   ```bash
+   nix build .#nixosConfigurations.sovran_systemsos-iso.config.system.build.isoImage
+   ```
+3. Copy, checksum, verify, and optionally upload to CDN:
+   ```bash
+   ./scripts/upload-cdn.sh --upload
+   ```
+
 ### Common development commands
 
 Run these commands from the flake root.
@@ -610,6 +628,7 @@ sudo nixos-rebuild switch --rollback
 | `modules/` | Core modules, Bitcoin services, self-hosted services, and optional features |
 | `modules/core/` | Roles, Hub integration, Caddy, desktop, support, and other core behavior |
 | `app/` | Sovran Hub backend, templates, static assets, scripts, and web interface |
+| `scripts/` | Automated release, build, and CDN upload utility scripts |
 | `iso/` | Installer configuration, installer code, and installer assets |
 | `packages/` | Custom package sources and patches (for example, Alby Hub) |
 | `assets/` | Documentation images |
@@ -860,7 +879,7 @@ primary location for collaboration. Please read our
 ## Privacy. Sovereignty. Bitcoin.
 
 [Visit Sovran Systems](https://sovransystems.com) ·
-[Download Sovran_SystemsOS](https://downloads.sovransystems.com/Sovran_SystemsOS.iso) ·
+[Download Sovran_SystemsOS](https://downloads.sovransystems.com/Sovran_SystemsOS-1.0.5.iso) ·
 [View the License](LICENSE)
 
 </div>

scripts/release-stable.sh

@@ -424,6 +424,10 @@ echo -e "${GREEN}║           ✅ Release ${TAG} completed successfully!
 echo -e "${GREEN}╚════════════════════════════════════════════════════════════╝${NC}"
 echo
 echo "Next manual steps (recommended):"
+echo "  • Build the installer ISO:"
+echo "    nix build .#nixosConfigurations.sovran_systemsos-iso.config.system.build.isoImage"
+echo "  • Package, verify, and upload ISO to CDN:"
+echo "    ./scripts/upload-cdn.sh --upload"
 echo "  • Review and enhance the new section in CHANGELOG.md"
 echo "  • Push changes: git push ${GITHUB_REMOTE} HEAD:main && git push ${GITEA_REMOTE} HEAD:staging-dev"
 echo "  • Verify releases on both GitHub and Gitea"

scripts/upload-cdn.sh

@@ -0,0 +1,137 @@
+#!/usr/bin/env bash
+#
+# upload-cdn.sh
+# Copies built ISO out of the nix store, generates versioned SHA-256 checksum,
+# verifies it, and optionally uploads to CDN.
+#
+# Usage:
+#   ./scripts/upload-cdn.sh [--upload]
+#
+# Environment variables (optional):
+#   CDN_RSYNC_TARGET   - rsync destination (e.g. user@server:/var/www/downloads/)
+#   CDN_RCLONE_REMOTE  - rclone remote target (e.g. s3:my-bucket/downloads/)
+#   CDN_UPLOAD_CMD     - custom upload command
+#
+
+set -euo pipefail
+
+RED='\033[0;31m'
+GREEN='\033[0;32m'
+YELLOW='\033[1;33m'
+BLUE='\033[0;34m'
+CYAN='\033[0;36m'
+NC='\033[0m'
+
+# Read version from VERSION file
+if [ ! -f VERSION ]; then
+    echo -e "${RED}Error: VERSION file not found.${NC}" >&2
+    exit 1
+fi
+VERSION=$(cat VERSION | tr -d '\n\r ')
+ISO_NAME="Sovran_SystemsOS-${VERSION}.iso"
+SHA_NAME="${ISO_NAME}.sha256"
+
+echo -e "${BLUE}╔════════════════════════════════════════════════════════════╗${NC}"
+echo -e "${BLUE}║      Sovran_SystemsOS CDN ISO Packaging & Upload Tool      ║${NC}"
+echo -e "${BLUE}╚════════════════════════════════════════════════════════════╝${NC}"
+echo -e "  Version : ${CYAN}${VERSION}${NC}"
+echo -e "  ISO     : ${CYAN}${ISO_NAME}${NC}"
+echo
+
+# Locate or build ISO
+SRC_ISO=""
+if [ -f "result/iso/${ISO_NAME}" ]; then
+    SRC_ISO="result/iso/${ISO_NAME}"
+elif [ -f "result/iso/Sovran_SystemsOS.iso" ]; then
+    SRC_ISO="result/iso/Sovran_SystemsOS.iso"
+else
+    FOUND=$(find result -name "*.iso" 2>/dev/null | head -n 1 || true)
+    if [ -n "$FOUND" ]; then
+        SRC_ISO="$FOUND"
+    fi
+fi
+
+if [ -z "$SRC_ISO" ] || [ ! -f "$SRC_ISO" ]; then
+    echo -e "${YELLOW}Built ISO not found in result/. Building ISO via Nix...${NC}"
+    nix build .#nixosConfigurations.sovran_systemsos-iso.config.system.build.isoImage
+    
+    if [ -f "result/iso/${ISO_NAME}" ]; then
+        SRC_ISO="result/iso/${ISO_NAME}"
+    else
+        FOUND=$(find result -name "*.iso" 2>/dev/null | head -n 1 || true)
+        if [ -n "$FOUND" ]; then
+            SRC_ISO="$FOUND"
+        else
+            echo -e "${RED}Error: Failed to locate built ISO in result/.${NC}" >&2
+            exit 1
+        fi
+    fi
+fi
+
+echo -e "${BLUE}Step 1: Copying built ISO out of Nix store...${NC}"
+cp -v "$SRC_ISO" "./${ISO_NAME}"
+echo -e "  ${GREEN}✓${NC} Copied to ./${ISO_NAME}"
+
+echo
+echo -e "${BLUE}Step 2: Generating versioned SHA-256 checksum...${NC}"
+sha256sum "${ISO_NAME}" > "${SHA_NAME}"
+echo -e "  ${GREEN}✓${NC} Generated ${SHA_NAME}"
+cat "${SHA_NAME}"
+
+echo
+echo -e "${BLUE}Step 3: Verifying checksum...${NC}"
+sha256sum --check "${SHA_NAME}"
+echo -e "  ${GREEN}✓${NC} Checksum verified successfully"
+
+# Parse arguments for upload
+DO_UPLOAD=0
+for arg in "$@"; do
+    case $arg in
+        --upload)
+            DO_UPLOAD=1
+            shift
+            ;;
+    esac
+done
+
+if [ "$DO_UPLOAD" -eq 1 ]; then
+    echo
+    echo -e "${BLUE}Step 4: Uploading to CDN...${NC}"
+    
+    UPLOADED=0
+    if [ -n "${CDN_UPLOAD_CMD:-}" ]; then
+        echo -e "  Running custom CDN_UPLOAD_CMD..."
+        eval "$CDN_UPLOAD_CMD"
+        UPLOADED=1
+    fi
+
+    if [ -n "${CDN_RSYNC_TARGET:-}" ]; then
+        echo -e "  Uploading via rsync to ${CDN_RSYNC_TARGET}..."
+        rsync -avP "${ISO_NAME}" "${SHA_NAME}" "${CDN_RSYNC_TARGET}"
+        UPLOADED=1
+    fi
+
+    if [ -n "${CDN_RCLONE_REMOTE:-}" ]; then
+        echo -e "  Uploading via rclone to ${CDN_RCLONE_REMOTE}..."
+        rclone copy "${ISO_NAME}" "${SHA_NAME}" "${CDN_RCLONE_REMOTE}"
+        UPLOADED=1
+    fi
+
+    if [ "$UPLOADED" -eq 0 ]; then
+        echo -e "  ${YELLOW}⚠ Warning: --upload requested, but no upload method specified.${NC}"
+        echo -e "     Set CDN_RSYNC_TARGET, CDN_RCLONE_REMOTE, or CDN_UPLOAD_CMD."
+    else
+        echo -e "  ${GREEN}✓${NC} Upload complete."
+    fi
+else
+    echo
+    echo -e "${GREEN}╔════════════════════════════════════════════════════════════╗${NC}"
+    echo -e "${GREEN}║           ✅ ISO packaging & verification complete!        ║${NC}"
+    echo -e "${GREEN}╚════════════════════════════════════════════════════════════╝${NC}"
+    echo -e "Ready files:"
+    ls -lh "${ISO_NAME}" "${SHA_NAME}"
+    echo
+    echo "To upload to CDN, run:"
+    echo "  ./scripts/upload-cdn.sh --upload"
+    echo "(configure CDN_RSYNC_TARGET, CDN_RCLONE_REMOTE, or CDN_UPLOAD_CMD)"
+fi