Initial layout: README, changelog and Gitea release upload script

Binaries only, no source. Windows .exe/.msi go up as release attachments
(they are 64-77 MB each, too big for git history); .deb packages are
committed under debs/ like the other *-deb repos.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

.gitignore

@@ -0,0 +1,5 @@
+*.token
+.gitea-token
+SHA256SUMS
+*.exe
+*.msi

CHANGELOG.md

@@ -0,0 +1,20 @@
+# Changelog
+
+All released builds of darthvader. Versions are `<version>-<git hash>`; the
+hash is the source commit the binaries were built from and is what the app
+shows in its title bar, About dialog and in the version string it reports to
+DMR masters.
+
+## 0.1.0 — unreleased
+
+First packaged build.
+
+* Modes: M17, DMR (BrandMeister / TGIF / any Pi-Star style master), YSF, NXDN,
+  D-STAR, P25, EchoLink, AllStar (IAX), SvxLink, APRS and POCSAG/DAPNET.
+* Hardware: DV3000 / ThumbDV / DVstick AMBE+2 sticks (auto-probed), remote
+  AMBEserver over UDP, and the MD380 software vocoder.
+* Audio chain per direction: preamp → 7-band EQ → LADSPA → AGC → limiter,
+  per mode / peer / server.
+* Windows: `.exe` and `.msi` installers, 15 bundled LADSPA plugins
+  (compressors, gate, limiter, filters, de-esser, EQ, saturation) so chains
+  configured on Linux work unchanged.

README.md

@@ -0,0 +1,57 @@
+# darthvader — downloads
+
+Prebuilt packages for **darthvader**, the native desktop client for digital
+voice (M17 / DMR / YSF / NXDN / D-STAR / P25, EchoLink, AllStar, SvxLink, APRS,
+POCSAG) with DV3000 USB AMBE+2 support.
+
+This repository contains **binaries only** — no source. Source lives in a
+separate private repository; the published sources of the GPL components ship
+with each package.
+
+© 2025–2026 bjorne, SA7AUX — GNU General Public License v2 or later.
+
+## Windows
+
+Download from the [latest release](../../releases/latest):
+
+| File | For |
+|---|---|
+| `darthvader-<version>-win64.exe` | Normal install (NSIS), Start menu + desktop shortcut |
+| `darthvader-<version>-win64.msi` | MSI, for unattended/managed deployment |
+
+Windows 10/11 64-bit. The packages are **not code-signed**, so SmartScreen shows
+a warning — choose *More info* → *Run anyway*. Everything is bundled (Qt, codecs,
+LADSPA plugins); nothing else needs installing.
+
+Silent install:
+
+```cmd
+darthvader-<version>-win64.exe /S
+msiexec /i darthvader-<version>-win64.msi /qn
+```
+
+DV3000 / ThumbDV / DVstick sticks appear as COM ports through the FTDI VCP
+driver and are detected automatically. If audio stutters, lower the port's
+*Latency Timer* to 1–2 ms in Device Manager → Port Settings → Advanced.
+
+## Debian / Raspberry Pi OS
+
+`.deb` packages in [`debs/`](debs/) — bookworm and trixie, `amd64` and `arm64`
+(Pi Zero 2 W and newer):
+
+```sh
+sudo apt install ./darthvader_<version>_<arch>.deb
+```
+
+## Verifying downloads
+
+Each release lists SHA-256 sums in `SHA256SUMS`:
+
+```sh
+sha256sum -c SHA256SUMS
+```
+
+## Support
+
+Bug reports and questions: SA7AUX. Runs on Debian 12/13, Ubuntu 22.04+, Linux
+Mint, Raspberry Pi OS (arm64) and Windows 10/11.

scripts/release.sh

@@ -0,0 +1,58 @@
+#!/bin/bash
+# Publish a darthvader release to Gitea: creates (or reuses) the tag/release and
+# uploads the given files as attachments, plus a SHA256SUMS of them.
+#
+#   scripts/release.sh v0.1.0-244ef5d9 ../darthvader/dist-win-installers/*.exe ...
+#
+# The token is read from $GITEA_TOKEN, else from the file in $GITEA_TOKEN_FILE
+# (default ~/.gitea-token). It is passed to curl on stdin, so it never appears
+# in the command line, the process list or this repository.
+set -euo pipefail
+
+GITEA_URL=${GITEA_URL:-https://git.sa7aux.se}
+OWNER=${GITEA_OWNER:-bjorne}
+REPO=${GITEA_REPO:-darthvader-dist}
+TOKEN_FILE=${GITEA_TOKEN_FILE:-$HOME/.gitea-token}
+
+TAG=${1:-}
+shift || true
+if [ -z "$TAG" ] || [ $# -eq 0 ]; then
+    echo "usage: $0 <tag> <file> [file...]" >&2
+    exit 1
+fi
+
+TOKEN=${GITEA_TOKEN:-}
+if [ -z "$TOKEN" ]; then
+    [ -r "$TOKEN_FILE" ] || { echo "no token: set GITEA_TOKEN or put one in $TOKEN_FILE" >&2; exit 1; }
+    TOKEN=$(tr -d ' \t\r\n' < "$TOKEN_FILE")
+fi
+API="$GITEA_URL/api/v1/repos/$OWNER/$REPO"
+# curl reads the auth header from stdin (never argv); "$@" after it is the request
+api() { printf 'header = "Authorization: token %s"\n' "$TOKEN" | curl -sS --fail-with-body --config - "$@"; }
+
+# Checksums next to the files, over the basenames only
+WORK=$(mktemp -d)
+trap 'rm -rf "$WORK"' EXIT
+for f in "$@"; do
+    [ -r "$f" ] || { echo "missing file: $f" >&2; exit 1; }
+    (cd "$(dirname "$f")" && sha256sum "$(basename "$f")") >> "$WORK/SHA256SUMS"
+done
+
+echo "release $TAG -> $OWNER/$REPO"
+ID=$(api "$API/releases/tags/$TAG" 2>/dev/null | grep -oE '"id":[0-9]+' | head -1 | cut -d: -f2 || true)
+if [ -z "$ID" ]; then
+    ID=$(api -X POST -H "Content-Type: application/json" \
+             -d "{\"tag_name\":\"$TAG\",\"name\":\"darthvader $TAG\",\"body\":\"See CHANGELOG.md\",\"draft\":false,\"prerelease\":false}" \
+             "$API/releases" | grep -oE '"id":[0-9]+' | head -1 | cut -d: -f2)
+    echo "  created release id=$ID"
+else
+    echo "  reusing release id=$ID"
+fi
+[ -n "$ID" ] || { echo "could not create or find the release" >&2; exit 1; }
+
+for f in "$@" "$WORK/SHA256SUMS"; do
+    name=$(basename "$f")
+    echo "  uploading $name ($(du -h "$f" | cut -f1))"
+    api -X POST -F "attachment=@$f" "$API/releases/$ID/assets?name=$name" > /dev/null
+done
+echo "done: $GITEA_URL/$OWNER/$REPO/releases/tag/$TAG"