feat(packaging): COPR repository for Fedora

The spec builds from the tag archive and a vendored crates tarball when
git_dir is not defined, so COPR can build it without network access.
release.yml publishes the vendor tarball and submits the build to COPR
after the release is published.

Refs #42

docs/CHANGELOG.md

@@ -11,6 +11,11 @@ scratch (user data in `staging/` and `recovery/` is never touched by this).
 
 ## [Unreleased]
 
+### Added
+- **A COPR repository for Fedora**, so `dnf upgrade` brings each new release:
+  `sudo dnf copr enable narrrl/proton-drive-linux`. Every release also ships the vendored crates
+  as `proton-drive-linux-vendor-<version>.tar.xz`, which the COPR build uses offline (#42).
+
 ## [3.5.0] — 2026-10-16
 
 Schema: **44**. Queued changes get an index by kind and name, and each synced file remembers the

docs/DEVELOPMENT.md

@@ -150,22 +150,25 @@ to the GitHub wiki, so keep their file names.
 
 Releases are cut from `main` by pushing a `v*` tag. `.github/workflows/release.yml` then:
 
-1. checks that the tag, the workspace version in `Cargo.toml` and `pkgver` in
-   `packaging/PKGBUILD` agree;
+1. checks that the tag, the workspace version in `Cargo.toml`, `pkgver` in
+   `packaging/PKGBUILD` and the default version in `packaging/proton-drive-linux.spec` agree;
 2. runs the quality gates;
-3. builds the release binaries and packages a `.tar.gz`, a `.deb` and a GPG-signed `.rpm`, and
-   builds the Nix flake at the tag, which is what a flake input pinned to `vX.Y.Z` gets, and
-   pushes it to the `proton-drive-linux` Cachix cache (secret `CACHIX_AUTH_TOKEN`);
+3. builds the release binaries and packages a `.tar.gz`, a `.deb`, a GPG-signed `.rpm` and a
+   `.tar.xz` of the vendored crates, and builds the Nix flake at the tag, which is what a flake
+   input pinned to `vX.Y.Z` gets, and pushes it to the `proton-drive-linux` Cachix cache (secret
+   `CACHIX_AUTH_TOKEN`);
 4. publishes them as a GitHub release, with the version's section of `docs/CHANGELOG.md` as the
    notes;
 5. calls `.github/workflows/aur.yml`, which updates and pushes the AUR recipes and commits them
-   back to `main`.
+   back to `main`;
+6. calls `.github/workflows/copr.yml`, which builds the release in the
+   [COPR repository](../packaging/copr/README.md) (secret `COPR_CONFIG`).
 
 To prepare a release:
 
 ```bash
-# 1. Bump the version in Cargo.toml, packaging/PKGBUILD, po/pdfs.pot and the pinned flake
-#    URL in docs/INSTALL.md, then refresh the lock file.
+# 1. Bump the version in Cargo.toml, packaging/PKGBUILD, packaging/proton-drive-linux.spec,
+#    po/pdfs.pot and the pinned flake URL in docs/INSTALL.md, then refresh the lock file.
 cargo update --workspace
 # 2. Move the [Unreleased] notes in docs/CHANGELOG.md under the new version.
 # 3. Commit, tag and push.

docs/INSTALL.md

@@ -59,6 +59,17 @@ sudo apt install ./proton-drive-linux_*_amd64.deb
 
 ### Fedora (44 or newer)
 
+The [COPR repository](https://copr.fedorainfracloud.org/coprs/narrrl/proton-drive-linux/) builds
+every release, so `dnf upgrade` keeps the client up to date:
+
+```bash
+sudo dnf copr enable narrrl/proton-drive-linux
+sudo dnf install proton-drive-linux
+```
+
+The `.rpm` from the release page installs the same files, but you have to download each new
+version yourself:
+
 ```bash
 sudo dnf install ./proton-drive-linux-*.x86_64.rpm
 ```

docs/SECURITY_MODEL.md

@@ -75,7 +75,9 @@ operations, and the client only writes them to its local log.
 
 ## Packages
 
-- The `.rpm` is signed with GPG.
+- The `.rpm` on the release page is signed with GPG.
+- The COPR packages are built by Fedora's COPR service from the tagged source and the vendored
+  crates of the release, and are signed with the COPR project's own key.
 - The `.deb` and the `.tar.gz` are built by GitHub Actions from the tagged source, and are not
   signed.
 - The AUR packages build from the tagged source or from `main`, or install the release binaries