Finish multi-platform release restructuring (previous commit was incomplete)

git add silently staged nothing from the previous attempt because one
pathspec in that batch (scripts/release/repository, already moved) no
longer existed — only the .gitignore-adjacent renames landed. This
commit adds what was actually meant to go in:

- core/updater.py: releases/download/updates-<platform>/ instead of a
  single shared updates/ tag.
- labui.spec: bundles root.json from this platform's own tree.
- scripts/release/repo_init.py, repo_release.py: auto-detect platform,
  operate inside scripts/release/<platform>/.
- .gitignore: per-platform ignore rules (previous commit only carried
  the file renames, not this).
- docs/building.md, scripts/release/README.md: rewritten for the
  per-platform flow.
- Also picks up pre-existing local TUF re-signing (new snapshot/
  timestamp signatures, bumped expiry/version) that was sitting
  uncommitted before this restructuring started.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

1 files changed, 39 insertions, 14 deletions

diff --git a/scripts/release/repo_release.py b/scripts/release/repo_release.py
index d50e458..7e4c382 100644
--- a/scripts/release/repo_release.py
+++ b/scripts/release/repo_release.py
@@ -1,18 +1,23 @@
 """
 scripts/release/repo_release.py
 
-Run after every `pyinstaller labui.spec` build, from anywhere (paths are
-made absolute below before the working directory changes). Packages the
-freshly built dist/LabUI bundle as a new signed tufup target.
+Run after every `pyinstaller labui.spec` build, on the same platform that
+build was produced on (no cross-compiling — this packages whatever
+dist/LabUI/ currently contains, which is only correct for the OS the build
+just ran on). Packages the freshly built dist/LabUI bundle as a new signed
+tufup target, in that platform's own repo tree.
 
 Prerequisites:
-  - repo_init.py has been run once already (./repository and ./keystore exist)
+  - repo_init.py has been run once already for this platform
+    (./<platform>/repository and ./<platform>/keystore exist)
   - core/version.py has been bumped to the new version
-  - dist/LabUI/ exists (pyinstaller labui.spec has just been run)
+  - dist/LabUI/ exists (pyinstaller labui.spec has just been run, on this
+    same machine/OS)
 
 After this completes, see README.md in this directory for how to publish
-the updated ./repository/metadata and ./repository/targets files to the
-"updates" GitHub Release.
+the updated ./<platform>/repository/metadata and
+./<platform>/repository/targets files to the "updates-<platform>" GitHub
+Release.
 """
 
 import os
@@ -23,8 +28,21 @@ _THIS_DIR   = Path(__file__).resolve().parent
 _REPO_ROOT  = _THIS_DIR.parent.parent
 _DIST_DIR   = _REPO_ROOT / "dist" / "LabUI"
 
+
+def _platform_key() -> str:
+    """win / mac / linux — must match core.updater._platform_key() and the
+    "updates-<key>" release tag on the publishing side."""
+    if sys.platform.startswith("win"):
+        return "win"
+    if sys.platform == "darwin":
+        return "mac"
+    return "linux"
+
+
+PLATFORM = _platform_key()
+
 # Import core.version before changing cwd — needs the repo root on sys.path,
-# which won't be true anymore once we chdir into scripts/release below.
+# which won't be true anymore once we chdir into scripts/release/<platform>.
 sys.path.insert(0, str(_REPO_ROOT))
 from core.version import __version__ as APP_VERSION
 
@@ -32,19 +50,25 @@ from tufup.repo import Repository
 
 # tufup's config file / relative repo_dir / keys_dir all resolve against cwd
 # (same reasoning as repo_init.py) — pin it here too, for the same reason.
-os.chdir(_THIS_DIR)
+_PLATFORM_DIR = _THIS_DIR / PLATFORM
+os.chdir(_PLATFORM_DIR)
 
 
 def main():
     if not _DIST_DIR.is_dir():
         raise SystemExit(
             f"{_DIST_DIR} not found — run `pyinstaller labui.spec` from the "
-            f"repo root first."
+            f"repo root first, on this same machine/OS."
+        )
+    if not (_PLATFORM_DIR / "repository").is_dir():
+        raise SystemExit(
+            f"{_PLATFORM_DIR / 'repository'} not found — run "
+            f"`python repo_init.py` once for this platform first."
         )
 
     repo = Repository.from_config()
 
-    changelog = input(f"One-line changelog for v{APP_VERSION} (optional): ").strip()
+    changelog = input(f"One-line changelog for v{APP_VERSION} ({PLATFORM}, optional): ").strip()
     custom_metadata = {"changelog": changelog} if changelog else None
 
     repo.add_bundle(
@@ -55,9 +79,10 @@ def main():
     )
     repo.publish_changes(private_key_dirs=[Path("keystore")])
 
-    print(f"Signed and published v{APP_VERSION} to ./repository")
-    print("Next: upload ./repository/metadata/* and ./repository/targets/* "
-          "to the 'updates' GitHub Release — see README.md in this directory.")
+    print(f"Signed and published v{APP_VERSION} ({PLATFORM}) to {_PLATFORM_DIR / 'repository'}")
+    print(f"Next: upload {_PLATFORM_DIR / 'repository' / 'metadata'}/* and "
+          f"{_PLATFORM_DIR / 'repository' / 'targets'}/* to the "
+          f"'updates-{PLATFORM}' GitHub Release — see README.md in this directory.")
 
 
 if __name__ == "__main__":