fix(scripts): keep ISO artifacts out of the repo and auto-update README on release

Remove duplicate version 1.0.6 details from CHANGELOG.md.

CHANGELOG.md

@@ -51,50 +51,6 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - Clarify GitHub is the dev mirror of the Gitea stable repo
 [1.0.6]: https://git.sovransystems.com/Sovran_Systems/Sovran_SystemsOS/releases/tag/v1.0.6
 
-
-## [1.0.6] - 2026-08-07
-
-### Added
-- Iso: fix replaceStrings length mismatch in cleanVersion
-- Promote virtual machine trial option in README
-- Improve installer VM compatibility
-- Trim redundant dev-vs-stable Gitea explanations in README
-- Add Arean.Ai to AI tools used for development
-- Prefix OS version badge with 'v' (v1.0.5)
-- Match OS version badge styling to service modal version badges
-- Place OS version badge inline right after the Hub title
-- Center OS version badge under the Hub title
-- Strengthen entropy section: add DYOR emphasis and hardware wallet verification note
-- Add 'About Bitcoin wallet entropy' section to README
-- README: balance intro between Bitcoin sovereignty and sovereign computing
-
-### Changed
-- Removed temp patch file
-
-### Fixed
-- Harden error handling and sanitize exception details across security endpoints (CWE-209)
-- Sanitize exception handling in verify-integrity and security-reset (CWE-209)
-- Sanitize api_security_reset errors to prevent exception information exposure (CWE-209)
-- Use canonical prefix containment check for CodeQL path-injection
-- Pass sanitized abs_path to os.chown to resolve CodeQL path injection at 4338
-- Add CodeQL-recognized path sanitization for domain_name
-- Remove domain substring check for CodeQL incomplete-url
-- Use sentinel for njalla header check (CodeQL incomplete-url-substring)
-- Prevent reflected XSS in lnurl-qr print endpoint
-- Hash root password instead of storing in clear text (CWE-312)
-- Separate web auth hash from system password file
-- Fix Matrix Hub admin API credentials
-- Fix CWE-78: replace subprocess call with Synapse Admin API in create-user endpoint
-
-### Documentation
-- Add SECURITY.md detailing security policy and best practices
-- Versioned CDN downloads + add CDN upload script
-- Correct active development workflow
-- Make repo references mirror-neutral for Gitea readers
-- Clarify GitHub is the dev mirror of the Gitea stable repo
-[1.0.6]: https://git.sovransystems.com/Sovran_Systems/Sovran_SystemsOS/releases/tag/v1.0.6
-
-
 ## [1.0.5] - 2026-08-04
 
 ### Added

scripts/release-stable.sh

@@ -283,6 +283,36 @@ git add VERSION
 git commit -m "chore: bump VERSION to ${TAG} for ISO naming" || true
 echo -e "  ${GREEN}✓${NC} VERSION file updated to ${VERSION}"
 
+# ─────────────────────────────────────────────────────────────────────────────
+# Step 2b: Auto-update README.md ISO download references
+# ─────────────────────────────────────────────────────────────────────────────
+echo
+echo -e "${BLUE}Step 2b: Updating README.md ISO references to ${VERSION}...${NC}"
+
+README_FILE="README.md"
+if [ -f "$README_FILE" ]; then
+    # Extract the version currently used in the README's ISO filenames,
+    # e.g. "Sovran_SystemsOS-1.0.6.iso" -> "1.0.6"
+    OLD_ISO_VER=$(grep -oE 'Sovran_SystemsOS-[0-9]+\.[0-9]+\.[0-9]+\.iso' "$README_FILE" | head -1 | sed 's/Sovran_SystemsOS-//; s/\.iso//')
+
+    if [ -n "$OLD_ISO_VER" ] && [ "$OLD_ISO_VER" != "$VERSION" ]; then
+        # Portable in-place edit (works with GNU sed and BSD/macOS sed)
+        sed "s/Sovran_SystemsOS-${OLD_ISO_VER}/Sovran_SystemsOS-${VERSION}/g" \
+            "$README_FILE" > "$README_FILE.tmp" && mv "$README_FILE.tmp" "$README_FILE"
+
+        UPDATED=$(grep -c "Sovran_SystemsOS-${VERSION}" "$README_FILE")
+        echo -e "  ${GREEN}✓${NC} README.md: ${OLD_ISO_VER} -> ${VERSION} (${UPDATED} references updated)"
+
+        git add "$README_FILE"
+        git commit -m "docs: update README ISO download links to ${TAG}" || true
+        echo -e "  ${GREEN}✓${NC} Committed README update"
+    else
+        echo -e "  ${YELLOW}⚠${NC} README.md already references ${VERSION} or no versioned ISO links found — skipping"
+    fi
+else
+    echo -e "  ${YELLOW}⚠${NC} README.md not found — skipping"
+fi
+
 # ─────────────────────────────────────────────────────────────────────────────
 # Step 3: Auto-update CHANGELOG.md
 # ─────────────────────────────────────────────────────────────────────────────

scripts/upload-cdn.sh

@@ -7,7 +7,15 @@
 # Usage:
 #   ./scripts/upload-cdn.sh [--upload]
 #
+# EVERYTHING this script creates lives OUTSIDE the repository, even when you
+# run it from inside the repo:
+#   - the nix build output symlink  -> $ISO_OUT_DIR/result
+#   - the ISO and .sha256 files     -> $ISO_OUT_DIR
+# The repo working tree stays completely clean.
+#
 # Environment variables (optional):
+#   ISO_OUT_DIR        - dir for the build symlink + ISO + checksum
+#                        (default: ~/Sovran-builds)
 #   CDN_RSYNC_TARGET   - rsync destination (e.g. user@server:/var/www/downloads/)
 #   CDN_RCLONE_REMOTE  - rclone remote target (e.g. s3:my-bucket/downloads/)
 #   CDN_UPLOAD_CMD     - custom upload command
@@ -22,65 +30,88 @@ BLUE='\033[0;34m'
 CYAN='\033[0;36m'
 NC='\033[0m'
 
+# Always operate from the repo root, no matter where the script is invoked from
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+REPO_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
+cd "$REPO_ROOT"
+
 # Read version from VERSION file
 if [ ! -f VERSION ]; then
-    echo -e "${RED}Error: VERSION file not found.${NC}" >&2
+    echo -e "${RED}Error: VERSION file not found in $REPO_ROOT.${NC}" >&2
     exit 1
 fi
 VERSION=$(cat VERSION | tr -d '\n\r ')
 ISO_NAME="Sovran_SystemsOS-${VERSION}.iso"
 SHA_NAME="${ISO_NAME}.sha256"
 
+# Output directory OUTSIDE the repo (override with ISO_OUT_DIR)
+OUT_DIR="${ISO_OUT_DIR:-$HOME/Sovran-builds}"
+mkdir -p "$OUT_DIR"
+OUT_DIR="$(cd "$OUT_DIR" && pwd)"
+ISO_PATH="$OUT_DIR/${ISO_NAME}"
+SHA_PATH="$OUT_DIR/${SHA_NAME}"
+RESULT_LINK="$OUT_DIR/result"
+
 echo -e "${BLUE}╔════════════════════════════════════════════════════════════╗${NC}"
 echo -e "${BLUE}║      Sovran_SystemsOS CDN ISO Packaging & Upload Tool      ║${NC}"
 echo -e "${BLUE}╚════════════════════════════════════════════════════════════╝${NC}"
 echo -e "  Version : ${CYAN}${VERSION}${NC}"
 echo -e "  ISO     : ${CYAN}${ISO_NAME}${NC}"
+echo -e "  Repo    : ${CYAN}${REPO_ROOT}${NC}   (left untouched)"
+echo -e "  Output  : ${CYAN}${OUT_DIR}${NC}   (outside the repo)"
 echo
 
 # Locate or build ISO
 SRC_ISO=""
-if [ -f "result/iso/${ISO_NAME}" ]; then
+if [ -f "$RESULT_LINK/iso/${ISO_NAME}" ]; then
-    SRC_ISO="result/iso/${ISO_NAME}"
+    SRC_ISO="$RESULT_LINK/iso/${ISO_NAME}"
+elif [ -f "$RESULT_LINK/iso/Sovran_SystemsOS.iso" ]; then
+    SRC_ISO="$RESULT_LINK/iso/Sovran_SystemsOS.iso"
+elif [ -f "result/iso/${ISO_NAME}" ]; then
+    SRC_ISO="result/iso/${ISO_NAME}"   # legacy: from an older in-repo build
 elif [ -f "result/iso/Sovran_SystemsOS.iso" ]; then
     SRC_ISO="result/iso/Sovran_SystemsOS.iso"
 else
-    FOUND=$(find result -name "*.iso" 2>/dev/null | head -n 1 || true)
+    FOUND=$(find "$RESULT_LINK" result -name "*.iso" 2>/dev/null | head -n 1 || true)
     if [ -n "$FOUND" ]; then
         SRC_ISO="$FOUND"
     fi
 fi
 
 if [ -z "$SRC_ISO" ] || [ ! -f "$SRC_ISO" ]; then
-    echo -e "${YELLOW}Built ISO not found in result/. Building ISO via Nix...${NC}"
+    echo -e "${YELLOW}Built ISO not found. Building via Nix (result link goes outside the repo)...${NC}"
-    nix build .#nixosConfigurations.sovran_systemsos-iso.config.system.build.isoImage
+    rm -f "$RESULT_LINK"
+    nix build .#nixosConfigurations.sovran_systemsos-iso.config.system.build.isoImage \
+        --out-link "$RESULT_LINK"
 
-    if [ -f "result/iso/${ISO_NAME}" ]; then
+    if [ -f "$RESULT_LINK/iso/${ISO_NAME}" ]; then
-        SRC_ISO="result/iso/${ISO_NAME}"
+        SRC_ISO="$RESULT_LINK/iso/${ISO_NAME}"
     else
-        FOUND=$(find result -name "*.iso" 2>/dev/null | head -n 1 || true)
+        FOUND=$(find "$RESULT_LINK" -name "*.iso" 2>/dev/null | head -n 1 || true)
         if [ -n "$FOUND" ]; then
             SRC_ISO="$FOUND"
-        else
-            echo -e "${RED}Error: Failed to locate built ISO in result/.${NC}" >&2
-            exit 1
         fi
     fi
 fi
 
-echo -e "${BLUE}Step 1: Copying built ISO out of Nix store...${NC}"
+if [ -z "$SRC_ISO" ] || [ ! -f "$SRC_ISO" ]; then
-cp -v "$SRC_ISO" "./${ISO_NAME}"
+    echo -e "${RED}Error: Failed to locate built ISO.${NC}" >&2
-echo -e "  ${GREEN}✓${NC} Copied to ./${ISO_NAME}"
+    exit 1
+fi
+
+echo -e "${BLUE}Step 1: Copying built ISO to output dir (outside repo)...${NC}"
+cp -v "$SRC_ISO" "$ISO_PATH"
+echo -e "  ${GREEN}✓${NC} Copied to $ISO_PATH"
 
 echo
 echo -e "${BLUE}Step 2: Generating versioned SHA-256 checksum...${NC}"
-sha256sum "${ISO_NAME}" > "${SHA_NAME}"
+sha256sum "$ISO_PATH" > "$SHA_PATH"
-echo -e "  ${GREEN}✓${NC} Generated ${SHA_NAME}"
+echo -e "  ${GREEN}✓${NC} Generated $SHA_PATH"
-cat "${SHA_NAME}"
+cat "$SHA_PATH"
 
 echo
 echo -e "${BLUE}Step 3: Verifying checksum...${NC}"
-sha256sum --check "${SHA_NAME}"
+sha256sum --check "$SHA_PATH"
 echo -e "  ${GREEN}✓${NC} Checksum verified successfully"
 
 # Parse arguments for upload
@@ -107,13 +138,13 @@ if [ "$DO_UPLOAD" -eq 1 ]; then
 
     if [ -n "${CDN_RSYNC_TARGET:-}" ]; then
         echo -e "  Uploading via rsync to ${CDN_RSYNC_TARGET}..."
-        rsync -avP "${ISO_NAME}" "${SHA_NAME}" "${CDN_RSYNC_TARGET}"
+        rsync -avP "$ISO_PATH" "$SHA_PATH" "${CDN_RSYNC_TARGET}"
         UPLOADED=1
     fi
 
     if [ -n "${CDN_RCLONE_REMOTE:-}" ]; then
         echo -e "  Uploading via rclone to ${CDN_RCLONE_REMOTE}..."
-        rclone copy "${ISO_NAME}" "${SHA_NAME}" "${CDN_RCLONE_REMOTE}"
+        rclone copy "$ISO_PATH" "$SHA_PATH" "${CDN_RCLONE_REMOTE}"
         UPLOADED=1
     fi
 
@@ -128,8 +159,8 @@ else
     echo -e "${GREEN}╔════════════════════════════════════════════════════════════╗${NC}"
     echo -e "${GREEN}║           ✅ ISO packaging & verification complete!        ║${NC}"
     echo -e "${GREEN}╚════════════════════════════════════════════════════════════╝${NC}"
-    echo -e "Ready files:"
+    echo -e "Ready files (in ${CYAN}${OUT_DIR}${NC}, outside the repo):"
-    ls -lh "${ISO_NAME}" "${SHA_NAME}"
+    ls -lh "$ISO_PATH" "$SHA_PATH"
     echo
     echo "To upload to CDN, run:"
     echo "  ./scripts/upload-cdn.sh --upload"