Distribute release ISOs through the dl.zacharyzhang.com R2 host

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Kb7vDj6PHwymeDeSUUk1eX

AGENTS.md

@@ -22,7 +22,7 @@ This fork carries the OmarchyCN China-integration layer on top of upstream `base
 - Packaging: `packages/omarchy-pkgs-cn.patch` must be applied to the sibling `omarchy-pkgs` checkout so `omarchy-dev` ships `cn/`; keyring in `packages/omarchycn-keyring/`
 - Upstream repo mirror: `packages/sync-omarchy-repo.sh` + `.gitea/workflows/pkg-repo-sync.yml` mirror the upstream `[omarchy]` stable channel into the Gitea Arch registry every 6h; `pacman-stable.conf` lists the mirror first (upstream fallback), clients must trust the registry key (install import + cn migration), `omarchycn doctor mirror --fix` re-heals the line; see `docs/pacman-repo.md`
 - ISO: `packages/omarchy-iso-cn.patch` must be applied to the sibling `omarchy-iso` checkout — Chinese installer (cage+foot graphical console with English VT fallback) and live-env packages
-- Release process: `docs/release-checklist.md`; signing: `docs/release-signing.md`; pacman repo: `docs/pacman-repo.md`
+- Release process: `docs/release-checklist.md`; signing: `docs/release-signing.md`; pacman repo: `docs/pacman-repo.md`; ISO distribution: Cloudflare R2 bucket behind `dl.zacharyzhang.com` via `packages/upload-release-r2.sh` (Gitea releases carry only the small artifacts)
 - Site: `site/` is the omarchycn.zacharyzhang.com landing page (Vite 8 vanilla + GSAP + self-hosted Fusion Pixel + reicon, kami palette on a 12-col grid); deploy with `npx wrangler deploy` from `site/`, rendered-state checks via `node shots.mjs` against a preview or the live URL
 - Chinese-first defaults: OmarchyCN ships Simplified Chinese as the default UX. User-visible strings in `default/omarchy/omarchy-menu.jsonc` (all labels), `default/hypr/bindings/*.lua` (bind descriptions, including the generated workspace/group/panel loops), `bin/omarchy-menu-keybindings` (its merge list and priority patterns must match the shipped Chinese descriptions), `bin/omarchy-update-confirm`, and `install/user/first-run/*` notifications are Chinese with brand names kept in English; menu search stays reachable in English through leaf ids. When syncing upstream, translate new strings in these files and resolve string conflicts toward our Chinese text.
 - Default set changes vs upstream: `install/omarchy-base.packages` adds fcitx5-rime/chinese-addons/configtool and drops aether/libreoffice-fresh/obs-studio; the Basecamp/Discord/HEY/Google/WhatsApp/X launchers, their webapp keybindings, the whatsapp-slim extension, and the HEY mailto handler are removed (preinstall add/remove lists, launcher.hides, chromium flags, and mimeapps stay in sync); `install/user/cn-chinese.sh` seeds IME/font config on zh_CN systems

docs/release-checklist.md

@@ -12,8 +12,12 @@
 8. `release.json`（版本、双向提交、包版本表、迁移列表、min_compatible、产物清单）→ 签名 release.json
 9. 把本次构建的 `omarchy-dev` / `omarchy-settings-dev` 发布到 [omarchycn] registry
     （`packages/publish-cn-packages.sh`；先于公开 Release，一键转换才不会装到旧包）
-10. 建 tag 与 Release，上传全部产物，Release Notes 写明上游基线与已知问题
-11. 匿名回读已发布 ISO 并 sha256 复核 == 本地构建值
+10. ISO 上传 R2 下载站：`packages/upload-release-r2.sh <版本> <iso>`（脚本自带匿名回读 sha256 复核，
+    并自动只保留最新 2 个版本目录；公网地址 `https://dl.zacharyzhang.com/<版本>/<文件名>`，
+    凭据在 `~/omarchycn-build/.r2.env`）
+11. 建 tag 与 Release，上传其余小件产物（SUMS/签名/SBOM/release.json），Release Notes 写明上游基线、
+    已知问题与 R2 ISO 下载链接；ISO 不再挂 Gitea 附件（带宽走 R2）
+12. 匿名回读 R2 ISO 与 Release 附件并 sha256 复核 == 本地构建值
 
 ## 版本规则
 

manual/zh-cn/01-install.md

@@ -2,7 +2,7 @@
 
 ## 下载与校验
 
-从 [Releases](https://git.zacharyzhang.com/ZacharyZhang-NY/omarchycn/releases) 下载最新 ISO 及 `SHA256SUMS.txt`、`SHA256SUMS.txt.asc`：
+ISO 从下载站 `https://dl.zacharyzhang.com/<版本>/<文件名>` 获取（[Releases](https://git.zacharyzhang.com/ZacharyZhang-NY/omarchycn/releases) 页面给出各版本的具体链接），`SHA256SUMS.txt`、`SHA256SUMS.txt.asc` 仍从 Releases 附件下载：
 
 ```bash
 curl -sSf https://git.zacharyzhang.com/ZacharyZhang-NY/omarchycn/raw/branch/quattro/cn/keys/omarchycn-release.asc | gpg --import

packages/upload-release-r2.sh

@@ -0,0 +1,41 @@
+#!/bin/bash
+# Upload release artifacts to the omarchycn-releases R2 bucket, then verify each
+# by anonymous public re-read (sha256 must match the local file).
+# Usage: upload-release-r2.sh <version> <file...>
+# Public URL shape: https://dl.zacharyzhang.com/<version>/<name>
+# Credentials: ~/omarchycn-build/.r2.env (rclone S3 env config, mode 0600)
+
+set -euo pipefail
+
+BUCKET=omarchycn-releases
+PUBLIC=https://dl.zacharyzhang.com
+
+version="${1:?usage: upload-release-r2.sh <version> <file...>}"
+shift
+(($#)) || { echo "no files given" >&2; exit 1; }
+
+source "$HOME/omarchycn-build/.r2.env"
+
+for f in "$@"; do
+  [[ -f $f ]] || { echo "no such file: $f" >&2; exit 1; }
+  name=$(basename "$f")
+  echo "==> $name -> $PUBLIC/$version/$name"
+  rclone copyto --s3-upload-cutoff 200M --s3-chunk-size 100M --retries 6 "$f" "r2:$BUCKET/$version/$name"
+  want=$(sha256sum "$f" | cut -d' ' -f1)
+  got=$(curl -fsSL "$PUBLIC/$version/$name" | sha256sum | cut -d' ' -f1)
+  if [[ $want != "$got" ]]; then
+    echo "sha256 mismatch for $name: local $want public $got" >&2
+    exit 1
+  fi
+  echo "verified $want"
+done
+
+# Keep the newest two release prefixes (current + rollback), purge older ones
+keep=2
+mapfile -t versions < <(rclone lsf --dirs-only "r2:$BUCKET" | sed 's|/$||' | sort -V)
+if ((${#versions[@]} > keep)); then
+  for old in "${versions[@]:0:${#versions[@]}-keep}"; do
+    echo "==> purge old release $old"
+    rclone purge "r2:$BUCKET/$old"
+  done
+fi

site/index.html

@@ -36,7 +36,7 @@
               <div class="actions" style="grid-column: 1 / 13">
                 <a
                   class="btn"
-                  href="https://git.zacharyzhang.com/ZacharyZhang-NY/omarchycn/releases/download/4.0.0.alpha-cn.6/omarchy-2026.08.27-x86_64-local.iso"
+                  href="https://dl.zacharyzhang.com/4.0.0.alpha-cn.6/omarchy-2026.08.27-x86_64-local.iso"
                 >
                   <span class="i" data-icon="Download" aria-hidden="true"></span>下载 ISO<span class="btn-meta">5.9 GB</span>
                 </a>