Arch packages implementation

[ghost]

close #25037

This PR adds a package registry for Arch Linux packages with support for package files, signatures, and automatic pacman-database management.

Features:

1. Push endpoints to upload package with or without signatures
2. Delete endpoint for specific package version and all related files
3. Get endpoint which is working for package files, gpg signature files and pacman database files
4. Package UI with instructions to connect to the new pacman database and visualised package metadata

You can follow this tutorial to build a *.pkg.tar.zst package for testing

Co-authored-by: @KN4CK3R
Co-authored-by: @silverwind

[silverwind]

The logo is not centered on its viewbox. Suggesting to replace it with https://www.svgrepo.com/svg/349296/arch-linux. I think we do use colored logos for other package types as well.

[silverwind]

You need to put the source svg as web_src/svg/gitea-arch.svg and then run make svg to get a optimized svg with name gitea-arch generated into public/img/svg which also needs to be checked in.

[KN4CK3R]

There are some things to address:

1. The routing should follow the current structure of other package types.
2. The storage of blobs must use the existing system.

[silverwind]

Looks good overall, can't really comment on go code though.

[p0da]

Any update on this @d1nch8g?

[ghost]

@p0da

I am trying to add a package proxy and UI for different package files (should be easier to validate checksums).

[ExplodingDragon]

Any new update on this @d1nch8g ?

[ghost]

@ExplodingDragon

Sorry for the delayed response. Not entirely sure about the proper way to implement package signature verification.

Ideally, that should be visible for each package file, along with checksums and other file-related properties, in an alike way as it is done with commit signatures.

[ExplodingDragon]

@ExplodingDragon

Sorry for the delayed response. Not entirely sure about the proper way to implement package signature verification.

Ideally, that should be visible for each package file, along with checksums and other file-related properties, in an alike way as it is done with commit signatures.

This is not a problem if pacman can be skipped in the configuration file.

In fact, rpm module doesn't do anything about signing rpm packages file either. (#27069)