packaging/repo.sh builds signed .deb, .rpm and Arch packages from a release tag with nfpm and publishes them to repo.dixon.cx, rebuilding the indexes over every project's packages there. It is vault's script with a mapsize project block. Release step 6 runs it; the README points users at dixon.cx/repo.