# The public key is materialized by CI from the NAROS_APT_PUBLIC_KEY secret (or by an
# operator into os/repo/keys/). No key in the tree, no keyring package — skip cleanly.
stage() {
  local dest="$1" key="$OS_DIR/repo/keys/naros-archive-keyring.gpg"
  if [ ! -f "$key" ]; then
    echo "public key missing: $key (CI materializes it from secrets)" > "$dest/.skip-reason"
    return 1
  fi
  install -D -m 0644 "$key" "$dest/usr/share/keyrings/naros-archive-keyring.gpg"
}