refactor: modernise RPM builder with Python tooling v2

- Migrate from legacy shell-based build system to modern Python tooling
- Update all metadata.yaml files to new schema with per-distro builds
- Standardise build scripts with curl -L, envsubst, and error handling
- Convert nfpm.yaml templates to use environment variable substitution
- Update Dockerfile to accept all package metadata as build arguments
- Modernise Makefile to use new Python build tool commands
- Update CI workflow to use tools/build instead of make

rpms/vault/resources/build.sh

@@ -1,11 +1,16 @@
 #!/usr/bin/bash
 
+set -e
+
 # Install dependencies
 dnf install -y unzip
 
 # Download and extract vault
-curl -o /app/vault.zip https://releases.hashicorp.com/vault/${PACKAGE_VERSION}/vault_${PACKAGE_VERSION}_linux_amd64.zip
+curl -L -o /app/vault.zip https://releases.hashicorp.com/vault/${PACKAGE_VERSION}/vault_${PACKAGE_VERSION}_linux_amd64.zip
 unzip vault.zip
 
+# Process the nfpm.yaml template with environment variables
+envsubst < /app/resources/nfpm.yaml > /app/nfpm.yaml
+
 # Build the RPM
-nfpm pkg --config /app/resources/nfpm.yaml --target /app/dist --packager rpm
+nfpm pkg --config /app/nfpm.yaml --target /app/dist --packager rpm

rpms/vault/resources/nfpm.yaml

@@ -1,17 +1,17 @@
 # nfpm.yaml
 
-name: vault
+name: ${PACKAGE_NAME}
 version: ${PACKAGE_VERSION}
 release: ${PACKAGE_RELEASE}
-arch: amd64
-platform: linux
+arch: ${PACKAGE_ARCH}
+platform: ${PACKAGE_PLATFORM}
 section: default
 priority: extra
-description: "Vault is a tool for securely accessing secrets. A secret is anything that you want to tightly control access to, such as API keys, passwords, certificates, and more. Vault provides a unified interface to any secret, while providing tight access control and recording a detailed audit log."
+description: "${PACKAGE_DESCRIPTION}"
 
-maintainer: HashiCorp
-homepage: https://github.com/hashicorp/vault
-license: BUSL-1.1
+maintainer: ${PACKAGE_MAINTAINER}
+homepage: ${PACKAGE_HOMEPAGE}
+license: ${PACKAGE_LICENSE}
 
 disable_globbing: false