Add opt-in Plasma fingerprint workaround

scripts/publish-fingerprint-workaround-payload

@@ -0,0 +1,53 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+usage() {
+    printf 'Usage: GITEA_TOKEN=... %s PATH_TO_RPM\n' "$0" >&2
+}
+
+if (( $# != 1 )); then
+    usage
+    exit 2
+fi
+
+repo_root=$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")/.." && pwd)
+payload_config="$repo_root/plasma-fingerprint-workaround/payload.conf"
+rpm_path=$1
+
+if [[ ! -f $rpm_path || $rpm_path != *.rpm ]]; then
+    printf 'Error: %s is not an RPM file.\n' "$rpm_path" >&2
+    exit 2
+fi
+
+if [[ -z ${GITEA_TOKEN:-} ]]; then
+    printf 'Error: set GITEA_TOKEN to a Gitea access token with package write permission.\n' >&2
+    exit 2
+fi
+
+payload_url=
+payload_sha256=
+# shellcheck source=/dev/null
+source "$payload_config"
+
+actual_sha256=$(sha256sum "$rpm_path")
+actual_sha256=${actual_sha256%% *}
+if [[ $actual_sha256 != "$payload_sha256" ]]; then
+    printf 'Error: RPM checksum does not match payload.conf.\n' >&2
+    exit 1
+fi
+
+if [[ ${rpm_path##*/} != "${payload_url##*/}" ]]; then
+    printf 'Error: RPM filename does not match payload.conf.\n' >&2
+    exit 1
+fi
+
+curl \
+    --fail-with-body \
+    --show-error \
+    --silent \
+    --user "ajp_anton:${GITEA_TOKEN}" \
+    --upload-file "$rpm_path" \
+    "$payload_url"
+
+printf 'Published %s as a generic Gitea package.\n' "$rpm_path"