From b5d046c91ad36cd80978253b5babb6589058b4c1 Mon Sep 17 00:00:00 2001
From: Jan Nedbal <jan.nedbal@apertia.cz>
Date: Tue, 14 Apr 2026 13:52:27 +0200
Subject: [PATCH] docs: link make-release.sh from update-manager doc

---
 docs/update-manager.md | 21 +++++++++++++++------
 1 file changed, 15 insertions(+), 6 deletions(-)

diff --git a/docs/update-manager.md b/docs/update-manager.md
index b901a071..a133086c 100644
--- a/docs/update-manager.md
+++ b/docs/update-manager.md
@@ -163,14 +163,23 @@ Files under `.updates/` are created by the launcher. The user shouldn't touch th
 
 1. On a trusted machine (not random laptop), with the private signing key present:
    ```bash
-   ./scripts/make-release.sh --version 2026.04.14-1 --source /path/to/fresh/client
+   ./scripts/make-release.sh --source /path/to/fresh/client --version 2026.04.14-1 \
+       --previous 2026.04.13-3 --notes notes.md --dry-run
    ```
-2. The script walks the client directory, computes sha256 for each file, writes a `manifest.json`, signs it, and produces a release directory `release/2026.04.14-1/` containing the manifest, its signature, and only the new blobs (ones not already present on the server).
+   [`scripts/make-release.sh`](../scripts/make-release.sh) is the single entry
+   point for the v1 manual flow. It drives `make-manifest.py` + `sign-manifest.py`,
+   builds the content-addressed blob tree under `files/<hash[0:2]>/<hash>` with
+   hardlink-based deduplication, archives the signed manifest into
+   `manifests/<version>.json`, and — unless `--dry-run` is passed — rsyncs the
+   blob tree first and the `manifest.json` + `manifest.json.sig` pair last so the
+   release becomes visible atomically. Flags: `--key` (default
+   `~/.config/metin/launcher-signing-key`, must be mode 600), `--out` (default
+   `/tmp/release-<version>`), `--force` to overwrite a non-empty out dir, `--yes`
+   to skip the interactive rsync confirmation, `--rsync-target <user@host:/path>`
+   to override the upload destination.
+2. The script walks the client directory, computes sha256 for each file, writes a `manifest.json`, signs it, and produces a release directory containing the manifest, its signature, and the deduplicated blob tree.
 3. Human review: diff the new manifest against the previous one, sanity-check size and file count.
-4. `rsync` the release directory to the VPS:
-   ```bash
-   rsync -av release/2026.04.14-1/ mt2.jakubkadlec.dev@mt2.jakubkadlec.dev:/var/www/updates.jakubkadlec.dev/
-   ```
+4. Re-run without `--dry-run` (same args) to rsync to the VPS. The script prints the target and waits for confirmation unless `--yes` is passed.
 5. Verify from a second machine: `curl` the manifest, check signature, check a random blob.
 6. Tag the release in git.