Merge branch 'master' into benvin/tea

Reviewed-on: #113

.gitea/workflows/build.yaml

@@ -1,59 +0,0 @@
-name: Build
-
-on:
-  pull_request:
-  workflow_call:
-  workflow_dispatch:
-
-jobs:
-  build-8:
-    runs-on: almalinux-8
-    container:
-      image: git.unkin.net/unkin/almalinux8-actionsdind:latest
-      options: "--privileged --volume /etc/pki/tls/vault:/etc/pki/tls/vault:ro"
-
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v3
-
-      - name: Build Packages
-        env:
-          VAULT_ROLE_ID: ${{ secrets.RPMBUILDER_VAULT_ROLEID }}
-        run: |
-          ./tools/build build-all --distro almalinux/el8
-
-      - name: Show RPMs
-        run: |
-          find /workspace -type f -name "*.rpm"
-
-      - name: Upload Artifacts
-        uses: actions/upload-artifact@v3
-        with:
-          name: rpms-8
-          path: /workspace/unkin/rpmbuilder/dist/*/*/*.rpm
-
-  build-9:
-    runs-on: almalinux-8
-    container:
-      image: git.unkin.net/unkin/almalinux9-actionsdind:latest
-      options: "--privileged --volume /etc/pki/tls/vault:/etc/pki/tls/vault:ro"
-
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v3
-
-      - name: Build Packages
-        env:
-          VAULT_ROLE_ID: ${{ secrets.RPMBUILDER_VAULT_ROLEID }}
-        run: |
-          ./tools/build build-all --distro almalinux/el9
-
-      - name: Show RPMs
-        run: |
-          find /workspace -type f -name "*.rpm"
-
-      - name: Upload Artifacts
-        uses: actions/upload-artifact@v3
-        with:
-          name: rpms-9
-          path: /workspace/unkin/rpmbuilder/dist/*/*/*.rpm

.gitea/workflows/deploy.yaml

@@ -1,66 +0,0 @@
-name: Deploy
-
-on:
-  push:
-    branches:
-      - master
-  workflow_dispatch:
-
-jobs:
-  deploy-8:
-    runs-on: almalinux-8
-    container:
-      image: git.unkin.net/unkin/almalinux8-actionsdind:latest
-      options: --privileged
-
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v3
-
-      - name: Download Artifacts
-        run: |
-          mkdir -p /workspace/unkin/rpmbuilder/dist/almalinux/el8
-          export PREVIOUS_RUN_ID=$((GITHUB_RUN_NUMBER - 1))
-          curl -L -o /workspace/rpms.zip "https://git.unkin.net/${GITHUB_REPOSITORY}/actions/runs/${PREVIOUS_RUN_ID}/artifacts/rpms-8"
-          unzip /workspace/rpms.zip -d /workspace/unkin/rpmbuilder/dist/almalinux/el8
-
-      - name: Show RPMs
-        run: |
-          find /workspace -type f -name "*.rpm"
-
-      - name: Upload RPMs to Gitea
-        env:
-          DRONECI_PASSWORD: ${{ secrets.DRONECI_PASSWORD }}
-        run: |
-          for rpm in $(find /workspace/unkin/rpmbuilder/dist/almalinux/el8 -type f -name "*.rpm"); do
-            curl --user droneci:${{ secrets.DRONECI_PASSWORD }} --upload-file $rpm https://git.unkin.net/api/packages/unkin/rpm/almalinux/el8/upload
-          done
-
-  deploy-9:
-    runs-on: almalinux-8
-    container:
-      image: git.unkin.net/unkin/almalinux9-actionsdind:latest
-      options: --privileged
-
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v3
-
-      - name: Download Artifacts
-        run: |
-          mkdir -p /workspace/unkin/rpmbuilder/dist/almalinux/el9
-          export PREVIOUS_RUN_ID=$((GITHUB_RUN_NUMBER - 1))
-          curl -L -o /workspace/rpms.zip "https://git.unkin.net/${GITHUB_REPOSITORY}/actions/runs/${PREVIOUS_RUN_ID}/artifacts/rpms-9"
-          unzip /workspace/rpms.zip -d /workspace/unkin/rpmbuilder/dist/almalinux/el9
-
-      - name: Show RPMs
-        run: |
-          find /workspace -type f -name "*.rpm"
-
-      - name: Upload RPMs to Gitea
-        env:
-          DRONECI_PASSWORD: ${{ secrets.DRONECI_PASSWORD }}
-        run: |
-          for rpm in $(find /workspace/unkin/rpmbuilder/dist/almalinux/el9 -type f -name "*.rpm"); do
-            curl --user droneci:${{ secrets.DRONECI_PASSWORD }} --upload-file $rpm https://git.unkin.net/api/packages/unkin/rpm/almalinux/el9/upload
-          done

.pre-commit-config.yaml

@@ -3,12 +3,24 @@ repos:
   - repo: https://github.com/pre-commit/pre-commit-hooks
     rev: v4.5.0
     hooks:
-      - id: trailing-whitespace
-      - id: end-of-file-fixer
+      - id: check-executables-have-shebangs
+      - id: check-json
+      - id: check-added-large-files
+        args: ['--maxkb=500']
+      - id: check-merge-conflict
+      - id: check-shebang-scripts-are-executable
+      - id: check-symlinks
+      - id: check-toml
       - id: check-yaml
         args: [--allow-multiple-documents]
-      - id: check-merge-conflict
+      - id: detect-aws-credentials
+        args: [--allow-missing-credentials]
       - id: detect-private-key
+      - id: end-of-file-fixer
+      - id: forbid-new-submodules
+      - id: pretty-format-json
+      - id: trailing-whitespace
+
   - repo: https://github.com/adrienverge/yamllint.git
     rev: v1.37.1
     hooks:
@@ -18,6 +30,7 @@ repos:
             "-d {extends: relaxed, rules: {line-length: disable}}",
             "-s",
           ]
+
   - repo: https://github.com/astral-sh/ruff-pre-commit
     rev: v0.14.7
     hooks:

.woodpecker/build-almalinux8.yaml

@@ -0,0 +1,20 @@
+when:
+  - event: pull_request
+
+steps:
+  - name: build rpms
+    image: git.unkin.net/unkin/almalinux9-rpmbuilder:latest
+    commands:
+      - mkdir -p /woodpecker/rpms
+      - ln -s /woodpecker/rpms /workspace
+      - dnf install buildah -y
+      - ./tools/build build-all --distro almalinux/el8 --buildah
+    privileged: true
+    backend_options:
+      kubernetes:
+        serviceAccountName: default
+
+  - name: show rpms
+    image: git.unkin.net/unkin/almalinux8-base:latest
+    commands:
+      - find /woodpecker/src/git.unkin.net/unkin/rpmbuilder/ -type f -name "*.rpm"

.woodpecker/build-almalinux9.yaml

@@ -0,0 +1,20 @@
+when:
+  - event: pull_request
+
+steps:
+  - name: build rpms
+    image: git.unkin.net/unkin/almalinux9-rpmbuilder:latest
+    commands:
+      - mkdir -p /woodpecker/rpms
+      - ln -s /woodpecker/rpms /workspace
+      - dnf install buildah -y
+      - ./tools/build build-all --distro almalinux/el9 --buildah
+    privileged: true
+    backend_options:
+      kubernetes:
+        serviceAccountName: default
+
+  - name: show rpms
+    image: git.unkin.net/unkin/almalinux9-base:latest
+    commands:
+      - find /woodpecker/src/git.unkin.net/unkin/rpmbuilder/ -type f -name "*.rpm"

.woodpecker/deploy-almalinux8.yaml

@@ -0,0 +1,37 @@
+when:
+  - event: push
+    branch: master
+
+steps:
+  - name: build-rpms
+    image: git.unkin.net/unkin/almalinux9-rpmbuilder:latest
+    commands:
+      - mkdir -p /woodpecker/rpms
+      - ln -s /woodpecker/rpms /workspace
+      - dnf install buildah -y
+      - ./tools/build build-all --distro almalinux/el8 --buildah
+    privileged: true
+    backend_options:
+      kubernetes:
+        serviceAccountName: default
+
+  - name: show-rpms
+    image: git.unkin.net/unkin/almalinux9-base:latest
+    commands:
+      - find /woodpecker/src/git.unkin.net/unkin/rpmbuilder/ -type f -name "*.rpm"
+    depends_on: [build-rpms]
+
+  - name: deploy-rpms
+    image: git.unkin.net/unkin/almalinux9-rpmbuilder:latest
+    commands:
+      - |
+        for rpm in $(find /woodpecker/src/git.unkin.net/unkin/rpmbuilder/ -type f -name "*.rpm"); do
+          curl --user droneci:$${DRONECI_PASSWORD} --upload-file $rpm https://git.unkin.net/api/packages/unkin/rpm/almalinux/el8/upload
+        done
+    environment:
+      DRONECI_PASSWORD:
+        from_secret: DRONECI_PASSWORD
+    backend_options:
+      kubernetes:
+        serviceAccountName: default
+    depends_on: [build-rpms, show-rpms]

.woodpecker/deploy-almalinux9.yaml

@@ -0,0 +1,37 @@
+when:
+  - event: push
+    branch: master
+
+steps:
+  - name: build-rpms
+    image: git.unkin.net/unkin/almalinux9-rpmbuilder:latest
+    commands:
+      - mkdir -p /woodpecker/rpms
+      - ln -s /woodpecker/rpms /workspace
+      - dnf install buildah -y
+      - ./tools/build build-all --distro almalinux/el9 --buildah
+    privileged: true
+    backend_options:
+      kubernetes:
+        serviceAccountName: default
+
+  - name: show-rpms
+    image: git.unkin.net/unkin/almalinux9-base:latest
+    commands:
+      - find /woodpecker/src/git.unkin.net/unkin/rpmbuilder/ -type f -name "*.rpm"
+    depends_on: [build-rpms]
+
+  - name: deploy-rpms
+    image: git.unkin.net/unkin/almalinux9-rpmbuilder:latest
+    commands:
+      - |
+        for rpm in $(find /woodpecker/src/git.unkin.net/unkin/rpmbuilder/ -type f -name "*.rpm"); do
+          curl --user droneci:$${DRONECI_PASSWORD} --upload-file $rpm https://git.unkin.net/api/packages/unkin/rpm/almalinux/el9/upload
+        done
+    environment:
+      DRONECI_PASSWORD:
+        from_secret: DRONECI_PASSWORD
+    backend_options:
+      kubernetes:
+        serviceAccountName: default
+    depends_on: [build-rpms, show-rpms]

.woodpecker/pre-commit.yaml

@@ -0,0 +1,9 @@
+when:
+  - event: pull_request
+
+steps:
+  - name: pre-commit
+    image: git.unkin.net/unkin/almalinux9-base:latest
+    commands:
+      - dnf install uv make -y
+      - uvx pre-commit run --all-files

Dockerfile

@@ -31,4 +31,4 @@ ENV PACKAGE_PLATFORM=${PACKAGE_PLATFORM}
 COPY resources /app/resources
 
 # Default command to build RPMs
-CMD /app/resources/build.sh
+CMD /app/resources/build.sh

Makefile

@@ -3,6 +3,10 @@ ROOT_DIR := $(PWD)
 BUILD_TOOL := $(ROOT_DIR)/tools/build
 DISTRO ?= almalinux/el9
 
+# Authentication variables (optional)
+# VAULT_ROLE_ID - Use AppRole authentication if set
+# VAULT_ROLE - Kubernetes role for service account authentication (default: rpmbuilder)
+
 # Automatically find all packages with metadata.yaml
 PACKAGES := $(shell find $(ROOT_DIR)/rpms -mindepth 1 -maxdepth 1 -type d -exec test -f {}/metadata.yaml \; -print | xargs -n1 basename | sort)
 
@@ -22,6 +26,16 @@ build-all:
 	@echo "Building all packages using Python tooling for distro $(DISTRO)..."
 	$(BUILD_TOOL) build-all --distro $(DISTRO)
 
+# Build all packages using native build (no Docker)
+build-all-native:
+	@echo "Building all packages natively (no Docker) for distro $(DISTRO)..."
+	$(BUILD_TOOL) build-all --distro $(DISTRO) --native
+
+# Build all packages using Buildah
+build-all-buildah:
+	@echo "Building all packages using Buildah for distro $(DISTRO)..."
+	$(BUILD_TOOL) build-all --distro $(DISTRO) --buildah
+
 # Build specific package using Python tool
 .PHONY: $(PACKAGES)
 $(PACKAGES):

rpms/boilerplate/resources/build.sh

@@ -8,4 +8,4 @@ wget -O /app/boilerplate https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote
 envsubst < /app/resources/nfpm.yaml > /app/nfpm.yaml
 
 # Build the RPM
-nfpm pkg --config /app/nfpm.yaml --target /app/dist --packager rpm
+nfpm pkg --config /app/nfpm.yaml --target /app/dist --packager rpm

rpms/claude-code/metadata.yaml

@@ -0,0 +1,18 @@
+---
+arch: amd64
+builds:
+  - image: git.unkin.net/unkin/almalinux8-rpmbuilder:latest
+    release: '1'
+    repository: [almalinux/el8]
+    version: 2.1.120
+  - image: git.unkin.net/unkin/almalinux9-rpmbuilder:latest
+    release: '1'
+    repository: [almalinux/el9]
+    version: 2.1.120
+claude_ai: true
+description: Claude Code - Anthropic's agentic AI coding tool
+homepage: https://claude.ai/code
+license: Proprietary
+maintainer: Anthropic
+name: claude-code
+platform: linux

rpms/claude-code/resources/build.sh

@@ -0,0 +1,13 @@
+#!/usr/bin/bash
+
+set -e
+
+# Download claude-code binary
+wget -O /app/claude https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/claude-ai/claude-code-releases/${PACKAGE_VERSION}/linux-x64/claude
+chmod +x /app/claude
+
+# Process the nfpm.yaml template with environment variables
+envsubst < /app/resources/nfpm.yaml > /app/nfpm.yaml
+
+# Build the RPM
+nfpm pkg --config /app/nfpm.yaml --target /app/dist --packager rpm

rpms/claude-code/resources/nfpm.yaml

@@ -0,0 +1,33 @@
+# nfpm.yaml
+
+name: ${PACKAGE_NAME}
+version: ${PACKAGE_VERSION}
+release: ${PACKAGE_RELEASE}
+arch: ${PACKAGE_ARCH}
+platform: ${PACKAGE_PLATFORM}
+section: default
+priority: extra
+description: "${PACKAGE_DESCRIPTION}"
+
+maintainer: ${PACKAGE_MAINTAINER}
+homepage: ${PACKAGE_HOMEPAGE}
+license: ${PACKAGE_LICENSE}
+
+disable_globbing: false
+
+replaces:
+  - claude-code
+  - claude
+
+provides:
+  - claude-code
+  - claude
+
+# Files to include in the package
+contents:
+  - src: /app/claude
+    dst: /usr/bin/claude
+    file_info:
+      mode: 0755
+      owner: root
+      group: root

rpms/cni-plugins/resources/build.sh

@@ -9,4 +9,4 @@ tar xf cni-plugins-linux-amd64.tgz
 envsubst < /app/resources/nfpm.yaml > /app/nfpm.yaml
 
 # Build the RPM
-nfpm pkg --config /app/nfpm.yaml --target /app/dist --packager rpm
+nfpm pkg --config /app/nfpm.yaml --target /app/dist --packager rpm

rpms/consul-cni/resources/build.sh

@@ -12,4 +12,4 @@ unzip consul-cni.zip
 # Process the nfpm.yaml template with environment variables
 envsubst < /app/resources/nfpm.yaml > /app/nfpm.yaml
 
-nfpm pkg --config /app/nfpm.yaml --target /app/dist --packager rpm
+nfpm pkg --config /app/nfpm.yaml --target /app/dist --packager rpm

rpms/consul/resources/build.sh

@@ -13,4 +13,4 @@ unzip consul.zip
 envsubst < /app/resources/nfpm.yaml > /app/nfpm.yaml
 
 # Build the RPM
-nfpm pkg --config /app/nfpm.yaml --target /app/dist --packager rpm
+nfpm pkg --config /app/nfpm.yaml --target /app/dist --packager rpm

rpms/etcd/resources/build.sh

@@ -10,4 +10,4 @@ mv /app/etcd-v${PACKAGE_VERSION}-linux-amd64/* /app/
 envsubst < /app/resources/nfpm.yaml > /app/nfpm.yaml
 
 # Build the RPM
-nfpm pkg --config /app/nfpm.yaml --target /app/dist --packager rpm
+nfpm pkg --config /app/nfpm.yaml --target /app/dist --packager rpm

rpms/g10k/resources/build.sh

@@ -11,4 +11,4 @@ popd
 envsubst < /app/resources/nfpm.yaml > /app/nfpm.yaml
 
 # Build the RPM
-nfpm pkg --config /app/nfpm.yaml --target /app/dist --packager rpm
+nfpm pkg --config /app/nfpm.yaml --target /app/dist --packager rpm

rpms/helmfile/resources/build.sh

@@ -15,4 +15,4 @@ chmod +x /app/helmfile
 # Process the nfpm.yaml template with environment variables
 envsubst < /app/resources/nfpm.yaml > /app/nfpm.yaml
 
-nfpm pkg --config /app/nfpm.yaml --target /app/dist --packager rpm
+nfpm pkg --config /app/nfpm.yaml --target /app/dist --packager rpm

rpms/jellyfin-ffmpeg-bin/resources/build.sh

@@ -14,4 +14,4 @@ rpmbuild -ba /root/rpmbuild/SPECS/jellyfin-ffmpeg-bin.spec
 
 # Copy the built RPMs to output directory
 cp /root/rpmbuild/RPMS/x86_64/jellyfin-ffmpeg-bin-*.rpm /app/dist/
-cp /root/rpmbuild/SRPMS/jellyfin-ffmpeg-bin-*.rpm /app/dist
+cp /root/rpmbuild/SRPMS/jellyfin-ffmpeg-bin-*.rpm /app/dist

rpms/jellyfin-server/resources/build.sh

@@ -18,4 +18,4 @@ rpmbuild -ba /app/resources/jellyfin-server_${PACKAGE_VERSION}.spec
 
 # Copy the built RPMs to output directory
 cp /root/rpmbuild/RPMS/x86_64/jellyfin-server-${PACKAGE_VERSION}-${PACKAGE_RELEASE}.x86_64.rpm /app/dist/
-cp /root/rpmbuild/SRPMS/jellyfin-server-${PACKAGE_VERSION}-${PACKAGE_RELEASE}.src.rpm /app/dist/
+cp /root/rpmbuild/SRPMS/jellyfin-server-${PACKAGE_VERSION}-${PACKAGE_RELEASE}.src.rpm /app/dist/

rpms/jellyfin-web/resources/build.sh

@@ -15,4 +15,4 @@ rpmbuild -ba /app/resources/jellyfin-web_${PACKAGE_VERSION}.spec
 
 # Copy the built RPMs to output directory
 cp /root/rpmbuild/RPMS/noarch/jellyfin-web-${PACKAGE_VERSION}-${PACKAGE_RELEASE}.noarch.rpm /app/dist/
-cp /root/rpmbuild/SRPMS/jellyfin-web-${PACKAGE_VERSION}-${PACKAGE_RELEASE}.src.rpm /app/dist/
+cp /root/rpmbuild/SRPMS/jellyfin-web-${PACKAGE_VERSION}-${PACKAGE_RELEASE}.src.rpm /app/dist/

rpms/jsonnet-language-server/resources/build.sh

@@ -11,4 +11,4 @@ chmod +x /app/jsonnet-language-server
 # Process the nfpm.yaml template with environment variables
 envsubst < /app/resources/nfpm.yaml > /app/nfpm.yaml
 
-nfpm pkg --config /app/nfpm.yaml --target /app/dist --packager rpm
+nfpm pkg --config /app/nfpm.yaml --target /app/dist --packager rpm

rpms/jsonnet-lint/resources/build.sh

@@ -20,4 +20,4 @@ GOBIN=/app go install github.com/google/go-jsonnet/cmd/jsonnet-lint@v${PACKAGE_V
 envsubst < /app/resources/nfpm.yaml > /app/nfpm.yaml
 
 # Build RPM package
-nfpm pkg --config /app/nfpm.yaml --target /app/dist --packager rpm
+nfpm pkg --config /app/nfpm.yaml --target /app/dist --packager rpm

rpms/jsonnet/resources/build.sh

@@ -21,4 +21,4 @@ GOBIN=/app go install github.com/google/go-jsonnet/cmd/jsonnetfmt@v${PACKAGE_VER
 envsubst < /app/resources/nfpm.yaml > /app/nfpm.yaml
 
 # Build RPM package
-nfpm pkg --config /app/nfpm.yaml --target /app/dist --packager rpm
+nfpm pkg --config /app/nfpm.yaml --target /app/dist --packager rpm

rpms/kubeconform/resources/build.sh

@@ -11,4 +11,4 @@ tar -xzf /app/kubeconform-linux-amd64.tar.gz -C /app/
 envsubst < /app/resources/nfpm.yaml > /app/nfpm.yaml
 
 # Build the RPM
-nfpm pkg --config /app/nfpm.yaml --target /app/dist --packager rpm
+nfpm pkg --config /app/nfpm.yaml --target /app/dist --packager rpm

rpms/libfoundationdb/resources/build.sh

@@ -11,4 +11,4 @@ chmod 755 /app/libfdb_c.so
 # Process the nfpm.yaml template with environment variables
 envsubst < /app/resources/nfpm.yaml > /app/nfpm.yaml
 
-nfpm pkg --config /app/nfpm.yaml --target /app/dist --packager rpm
+nfpm pkg --config /app/nfpm.yaml --target /app/dist --packager rpm

rpms/libfoundationdb/resources/scripts/postinstall.sh

@@ -1,4 +1,4 @@
 #!/usr/bin/env bash
 
 # Update the dynamic linker cache to include the new library
-ldconfig
+ldconfig

rpms/nfpm/resources/build.sh

@@ -11,4 +11,4 @@ GOBIN=/app go install github.com/goreleaser/nfpm/v2/cmd/nfpm@v${PACKAGE_VERSION}
 envsubst < /app/resources/nfpm.yaml > /app/nfpm.yaml
 
 # Build the RPM
-nfpm pkg --config /app/nfpm.yaml --target /app/dist --packager rpm
+nfpm pkg --config /app/nfpm.yaml --target /app/dist --packager rpm

rpms/nomad-autoscaler/resources/build.sh

@@ -12,4 +12,4 @@ unzip nomad-autoscaler.zip
 # Process the nfpm.yaml template with environment variables
 envsubst < /app/resources/nfpm.yaml > /app/nfpm.yaml
 
-nfpm pkg --config /app/nfpm.yaml --target /app/dist --packager rpm
+nfpm pkg --config /app/nfpm.yaml --target /app/dist --packager rpm

rpms/nomad/resources/build.sh

@@ -12,4 +12,4 @@ unzip nomad.zip
 # Process the nfpm.yaml template with environment variables
 envsubst < /app/resources/nfpm.yaml > /app/nfpm.yaml
 
-nfpm pkg --config /app/nfpm.yaml --target /app/dist --packager rpm
+nfpm pkg --config /app/nfpm.yaml --target /app/dist --packager rpm

rpms/nzbget/resources/build.sh

@@ -4,4 +4,4 @@ set -e
 
 # Download the pre-built RPM from GitHub releases
 curl -L -o /app/dist/nzbget-${PACKAGE_VERSION}-${PACKAGE_RELEASE}.x86_64.rpm \
-  https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/github/nzbgetcom/nzbget/releases/download/v$PACKAGE_VERSION/nzbget-${PACKAGE_VERSION}-${PACKAGE_RELEASE}.x86_64.rpm
+  https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/github/nzbgetcom/nzbget/releases/download/v$PACKAGE_VERSION/nzbget-${PACKAGE_VERSION}-${PACKAGE_RELEASE}.x86_64.rpm

rpms/openbao-plugin-secret-consul/resources/build.sh

@@ -17,4 +17,4 @@ chmod +x /app/openbao-plugin-secrets-consul
 # Process the nfpm.yaml template with environment variables
 envsubst < /app/resources/nfpm.yaml > /app/nfpm.yaml
 
-nfpm pkg --config /app/nfpm.yaml --target /app/dist --packager rpm
+nfpm pkg --config /app/nfpm.yaml --target /app/dist --packager rpm

rpms/openbao-plugin-secret-consul/resources/scripts/preinstall.sh

@@ -1,2 +1,2 @@
 #!/usr/bin/env bash
-mkdir -p /opt/openbao-plugins
+mkdir -p /opt/openbao-plugins

rpms/openbao-plugin-secret-nomad/resources/build.sh

@@ -17,4 +17,4 @@ chmod +x /app/openbao-plugin-secrets-nomad
 # Process the nfpm.yaml template with environment variables
 envsubst < /app/resources/nfpm.yaml > /app/nfpm.yaml
 
-nfpm pkg --config /app/nfpm.yaml --target /app/dist --packager rpm
+nfpm pkg --config /app/nfpm.yaml --target /app/dist --packager rpm

rpms/openbao-plugin-secret-nomad/resources/scripts/preinstall.sh

@@ -1,2 +1,2 @@
 #!/usr/bin/env bash
-mkdir -p /opt/openbao-plugins
+mkdir -p /opt/openbao-plugins

rpms/openbao-plugins/resources/build.sh

@@ -7,4 +7,4 @@ set -e
 envsubst < /app/resources/nfpm.yaml > /app/nfpm.yaml
 
 # Build the RPM
-nfpm pkg --config /app/nfpm.yaml --target /app/dist --packager rpm
+nfpm pkg --config /app/nfpm.yaml --target /app/dist --packager rpm

rpms/packer/resources/build.sh

@@ -13,4 +13,4 @@ unzip packer.zip
 envsubst < /app/resources/nfpm.yaml > /app/nfpm.yaml
 
 # Build the RPM
-nfpm pkg --config /app/nfpm.yaml --target /app/dist --packager rpm
+nfpm pkg --config /app/nfpm.yaml --target /app/dist --packager rpm

rpms/ruff/resources/build.sh

@@ -11,4 +11,4 @@ mv /app/ruff-x86_64-unknown-linux-gnu/* /app/
 envsubst < /app/resources/nfpm.yaml > /app/nfpm.yaml
 
 # Build the RPM
-nfpm pkg --config /app/nfpm.yaml --target /app/dist --packager rpm
+nfpm pkg --config /app/nfpm.yaml --target /app/dist --packager rpm

rpms/stalwart-cli/resources/build.sh

@@ -14,4 +14,4 @@ chmod +x /app/stalwart-cli
 # Process the nfpm.yaml template with environment variables
 envsubst < /app/resources/nfpm.yaml > /app/nfpm.yaml
 
-nfpm pkg --config /app/nfpm.yaml --target /app/dist --packager rpm
+nfpm pkg --config /app/nfpm.yaml --target /app/dist --packager rpm

rpms/stalwart-foundationdb/resources/build.sh

@@ -14,4 +14,4 @@ chmod +x /app/stalwart-foundationdb
 # Process the nfpm.yaml template with environment variables
 envsubst < /app/resources/nfpm.yaml > /app/nfpm.yaml
 
-nfpm pkg --config /app/nfpm.yaml --target /app/dist --packager rpm
+nfpm pkg --config /app/nfpm.yaml --target /app/dist --packager rpm

rpms/stalwart-foundationdb/resources/scripts/postremove.sh

@@ -4,4 +4,4 @@
 systemctl daemon-reload
 
 # Note: We don't remove user data, logs, or configuration files
-# to preserve user data in case of reinstallation
+# to preserve user data in case of reinstallation

rpms/stalwart-foundationdb/resources/scripts/preinstall.sh

@@ -17,4 +17,4 @@ mkdir -p /var/log/stalwart
 # Set ownership
 chown -R stalwart:stalwart /opt/stalwart
 chown -R stalwart:stalwart /var/lib/stalwart
-chown -R stalwart:stalwart /var/log/stalwart
+chown -R stalwart:stalwart /var/log/stalwart

rpms/stalwart-foundationdb/resources/scripts/preremove.sh

@@ -4,4 +4,4 @@
 if systemctl is-enabled stalwart-foundationdb.service >/dev/null 2>&1; then
     systemctl stop stalwart-foundationdb.service
     systemctl disable stalwart-foundationdb.service
-fi
+fi

rpms/stalwart-foundationdb/resources/stalwart-foundationdb.service

@@ -23,4 +23,4 @@ ProtectSystem=strict
 ReadWritePaths=/var/lib/stalwart /var/log/stalwart /opt/stalwart/data
 
 [Install]
-WantedBy=multi-user.target
+WantedBy=multi-user.target

rpms/stalwart/resources/build.sh

@@ -14,4 +14,4 @@ chmod +x /app/stalwart
 # Process the nfpm.yaml template with environment variables
 envsubst < /app/resources/nfpm.yaml > /app/nfpm.yaml
 
-nfpm pkg --config /app/nfpm.yaml --target /app/dist --packager rpm
+nfpm pkg --config /app/nfpm.yaml --target /app/dist --packager rpm

rpms/stalwart/resources/scripts/postremove.sh

@@ -4,4 +4,4 @@
 systemctl daemon-reload
 
 # Note: We don't remove user data, logs, or configuration files
-# to preserve user data in case of reinstallation
+# to preserve user data in case of reinstallation

rpms/stalwart/resources/scripts/preinstall.sh

@@ -17,4 +17,4 @@ mkdir -p /var/log/stalwart
 # Set ownership
 chown -R stalwart:stalwart /opt/stalwart
 chown -R stalwart:stalwart /var/lib/stalwart
-chown -R stalwart:stalwart /var/log/stalwart
+chown -R stalwart:stalwart /var/log/stalwart

rpms/stalwart/resources/scripts/preremove.sh

@@ -4,4 +4,4 @@
 if systemctl is-enabled stalwart.service >/dev/null 2>&1; then
     systemctl stop stalwart.service
     systemctl disable stalwart.service
-fi
+fi

rpms/stalwart/resources/stalwart.service

@@ -22,4 +22,4 @@ ProtectSystem=strict
 ReadWritePaths=/var/lib/stalwart /var/log/stalwart /opt/stalwart/data
 
 [Install]
-WantedBy=multi-user.target
+WantedBy=multi-user.target

rpms/stern/metadata.yaml

@@ -0,0 +1,20 @@
+---
+name: stern
+github: stern/stern
+description: Multi pod and container log tailing for Kubernetes.
+arch: amd64
+platform: linux
+maintainer: stern
+homepage: https://github.com/stern/stern
+license: Apache-2.0
+builds:
+- repository:
+  - almalinux/el8
+  image: git.unkin.net/unkin/almalinux8-rpmbuilder:latest
+  release: 1
+  version: 1.33.1
+- repository:
+  - almalinux/el9
+  image: git.unkin.net/unkin/almalinux9-rpmbuilder:latest
+  release: 1
+  version: 1.33.1

rpms/stern/resources/build.sh

@@ -0,0 +1,10 @@
+#!/usr/bin/bash
+
+set -e
+
+wget -O /app/stern_${PACKAGE_VERSION}_linux_amd64.tar.gz https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/github/stern/stern/releases/download/v${PACKAGE_VERSION}/stern_${PACKAGE_VERSION}_linux_amd64.tar.gz
+tar xf /app/stern_${PACKAGE_VERSION}_linux_amd64.tar.gz
+
+envsubst < /app/resources/nfpm.yaml > /app/nfpm.yaml
+
+nfpm pkg --config /app/nfpm.yaml --target /app/dist --packager rpm

rpms/stern/resources/nfpm.yaml

@@ -0,0 +1,30 @@
+# nfpm.yaml
+
+name: ${PACKAGE_NAME}
+version: ${PACKAGE_VERSION}
+release: ${PACKAGE_RELEASE}
+arch: ${PACKAGE_ARCH}
+platform: ${PACKAGE_PLATFORM}
+section: default
+priority: extra
+description: "${PACKAGE_DESCRIPTION}"
+
+maintainer: ${PACKAGE_MAINTAINER}
+homepage: ${PACKAGE_HOMEPAGE}
+license: ${PACKAGE_LICENSE}
+
+disable_globbing: false
+
+replaces:
+  - stern
+
+provides:
+  - stern
+
+contents:
+  - src: /app/stern
+    dst: /usr/bin/stern
+    file_info:
+      mode: 0755
+      owner: root
+      group: root

rpms/tea/metadata.yaml

@@ -0,0 +1,20 @@
+---
+name: tea
+github: unknown/tea
+description: The official CLI for Gitea.
+arch: amd64
+platform: linux
+maintainer: Gitea
+homepage: https://gitea.com/gitea/tea
+license: MIT
+builds:
+- repository:
+  - almalinux/el8
+  image: git.unkin.net/unkin/almalinux8-rpmbuilder:latest
+  release: 1
+  version: 0.14.0
+- repository:
+  - almalinux/el9
+  image: git.unkin.net/unkin/almalinux9-rpmbuilder:latest
+  release: 1
+  version: 0.14.0

rpms/tea/resources/build.sh

@@ -0,0 +1,10 @@
+#!/usr/bin/bash
+
+set -e
+
+curl -L --output /app/tea-linux-amd64 https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/gitea-dl/tea/${PACKAGE_VERSION}/tea-${PACKAGE_VERSION}-linux-amd64
+chmod +x /app/tea-linux-amd64
+
+envsubst < /app/resources/nfpm.yaml > /app/nfpm.yaml
+
+nfpm pkg --config /app/nfpm.yaml --target /app/dist --packager rpm

rpms/tea/resources/nfpm.yaml

@@ -0,0 +1,30 @@
+# nfpm.yaml
+
+name: ${PACKAGE_NAME}
+version: ${PACKAGE_VERSION}
+release: ${PACKAGE_RELEASE}
+arch: ${PACKAGE_ARCH}
+platform: ${PACKAGE_PLATFORM}
+section: default
+priority: extra
+description: "${PACKAGE_DESCRIPTION}"
+
+maintainer: ${PACKAGE_MAINTAINER}
+homepage: ${PACKAGE_HOMEPAGE}
+license: ${PACKAGE_LICENSE}
+
+disable_globbing: false
+
+replaces:
+  - tea
+
+provides:
+  - tea
+
+contents:
+  - src: /app/tea-linux-amd64
+    dst: /usr/bin/tea
+    file_info:
+      mode: 0755
+      owner: root
+      group: root

rpms/terraform/resources/build.sh

@@ -13,4 +13,4 @@ unzip terraform.zip
 envsubst < /app/resources/nfpm.yaml > /app/nfpm.yaml
 
 # Build the RPM
-nfpm pkg --config /app/nfpm.yaml --target /app/dist --packager rpm
+nfpm pkg --config /app/nfpm.yaml --target /app/dist --packager rpm

rpms/terragrunt/resources/build.sh

@@ -9,4 +9,4 @@ wget -O /app/terragrunt https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/
 envsubst < /app/resources/nfpm.yaml > /app/nfpm.yaml
 
 # Build the RPM
-nfpm pkg --config /app/nfpm.yaml --target /app/dist --packager rpm
+nfpm pkg --config /app/nfpm.yaml --target /app/dist --packager rpm

rpms/tflint/resources/build.sh

@@ -11,4 +11,4 @@ unzip -j /app/tflint_linux_amd64.zip -d /app/
 envsubst < /app/resources/nfpm.yaml > /app/nfpm.yaml
 
 # Build the RPM
-nfpm pkg --config /app/nfpm.yaml --target /app/dist --packager rpm
+nfpm pkg --config /app/nfpm.yaml --target /app/dist --packager rpm

rpms/unkin-ca-certificates/resources/build.sh

@@ -8,4 +8,4 @@ curl -L -o /app/UNKIN_ROOTCA_2024.crt https://vault.query.consul:8200/v1/pki_roo
 # Process the nfpm.yaml template with environment variables
 envsubst < /app/resources/nfpm.yaml > /app/nfpm.yaml
 
-nfpm pkg --config /app/nfpm.yaml --target /app/dist --packager rpm
+nfpm pkg --config /app/nfpm.yaml --target /app/dist --packager rpm

rpms/unrar/metadata.yaml

@@ -4,11 +4,11 @@ builds:
   - image: git.unkin.net/unkin/almalinux8-rpmbuilder:latest
     release: '1'
     repository: [almalinux/el8]
-    version: '7.12'
+    version: '7.20'
   - image: git.unkin.net/unkin/almalinux9-rpmbuilder:latest
     release: '1'
     repository: [almalinux/el9]
-    version: '7.12'
+    version: '7.20'
 description: WinRAR is a powerful archive manager. It can backup your data and reduce the size of email attachments, open and unpack RAR, ZIP and other files downloaded from Internet, create new archives in RAR and ZIP file format.
 github: unknown/unrar
 homepage: https://www.rarlab.com/

rpms/unrar/resources/build.sh

@@ -4,8 +4,8 @@ set -e
 
 # Download and extract unrar (with version formatting)
 export DOWNLOAD_VERSION=$(echo $PACKAGE_VERSION | sed s/\\.//)
-curl -L -o /app/rarlinux.tar.gz https://www.rarlab.com/rar/rarlinux-x64-${DOWNLOAD_VERSION}.tar.gz
-tar xf /app/rarlinux.tar.gz
+curl -L -o /app/rarlinux.tar.gz https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/rarlab/rar/rarlinux-x64-${DOWNLOAD_VERSION}.tar.gz
+tar xf /app/rarlinux.tar.gz -C /app
 mv /app/rar/unrar /app/
 
 # Process the nfpm.yaml template with environment variables

rpms/uv/resources/build.sh

@@ -11,4 +11,4 @@ mv /app/uv-x86_64-unknown-linux-gnu/* /app/
 envsubst < /app/resources/nfpm.yaml > /app/nfpm.yaml
 
 # Build the RPM
-nfpm pkg --config /app/nfpm.yaml --target /app/dist --packager rpm
+nfpm pkg --config /app/nfpm.yaml --target /app/dist --packager rpm

rpms/vals/resources/build.sh

@@ -15,4 +15,4 @@ chmod +x /app/vals
 # Process the nfpm.yaml template with environment variables
 envsubst < /app/resources/nfpm.yaml > /app/nfpm.yaml
 
-nfpm pkg --config /app/nfpm.yaml --target /app/dist --packager rpm
+nfpm pkg --config /app/nfpm.yaml --target /app/dist --packager rpm

rpms/vault/resources/build.sh

@@ -13,4 +13,4 @@ unzip vault.zip
 envsubst < /app/resources/nfpm.yaml > /app/nfpm.yaml
 
 # Build the RPM
-nfpm pkg --config /app/nfpm.yaml --target /app/dist --packager rpm
+nfpm pkg --config /app/nfpm.yaml --target /app/dist --packager rpm

rpms/victoria-logs/resources/build.sh

@@ -10,4 +10,4 @@ tar xf victoria-logs-linux-amd64-v${PACKAGE_VERSION}.tar.gz
 # Process the nfpm.yaml template with environment variables
 envsubst < /app/resources/nfpm.yaml > /app/nfpm.yaml
 
-nfpm pkg --config /app/nfpm.yaml --target /app/dist --packager rpm
+nfpm pkg --config /app/nfpm.yaml --target /app/dist --packager rpm

rpms/vlutils/resources/build.sh

@@ -10,4 +10,4 @@ tar xf vlutils-linux-amd64-v${PACKAGE_VERSION}.tar.gz
 # Process the nfpm.yaml template with environment variables
 envsubst < /app/resources/nfpm.yaml > /app/nfpm.yaml
 
-nfpm pkg --config /app/nfpm.yaml --target /app/dist --packager rpm
+nfpm pkg --config /app/nfpm.yaml --target /app/dist --packager rpm

rpms/vmutils/resources/build.sh

@@ -10,4 +10,4 @@ tar xf vmutils-linux-amd64-v${PACKAGE_VERSION}.tar.gz
 # Process the nfpm.yaml template with environment variables
 envsubst < /app/resources/nfpm.yaml > /app/nfpm.yaml
 
-nfpm pkg --config /app/nfpm.yaml --target /app/dist --packager rpm
+nfpm pkg --config /app/nfpm.yaml --target /app/dist --packager rpm

rpms/xh/resources/build.sh

@@ -11,4 +11,4 @@ mv /app/xh-v${PACKAGE_VERSION}-x86_64-unknown-linux-musl/* /app/
 envsubst < /app/resources/nfpm.yaml > /app/nfpm.yaml
 
 # Build the RPM
-nfpm pkg --config /app/nfpm.yaml --target /app/dist --packager rpm
+nfpm pkg --config /app/nfpm.yaml --target /app/dist --packager rpm

tools/build

@@ -156,7 +156,7 @@ class PackageMetadata:
 
 def get_vault_client() -> hvac.Client:
     """
-    Initialize and authenticate Vault client using AppRole authentication.
+    Initialize and authenticate Vault client using AppRole or Kubernetes authentication.
 
     Returns:
         Authenticated HVAC client
@@ -166,10 +166,7 @@ def get_vault_client() -> hvac.Client:
     # Get required environment variables
     vault_addr = os.getenv('VAULT_ADDR', 'https://vault.service.consul:8200')
     vault_role_id = os.getenv('VAULT_ROLE_ID')
-
-    if not vault_role_id:
-        logger.error("VAULT_ROLE_ID environment variable is required")
-        sys.exit(1)
+    vault_role = os.getenv('VAULT_ROLE', 'rpmbuilder')
 
     # Initialize Vault client with CA certificate
     client = hvac.Client(
@@ -177,21 +174,55 @@ def get_vault_client() -> hvac.Client:
         verify='/etc/pki/tls/cert.pem'
     )
 
-    # Authenticate using AppRole
-    try:
-        logger.debug(f"Authenticating to Vault at {vault_addr}")
-        client.auth.approle.login(role_id=vault_role_id)
+    # Use AppRole authentication if VAULT_ROLE_ID is available
+    if vault_role_id:
+        try:
+            logger.debug(f"Authenticating to Vault at {vault_addr} using AppRole")
+            client.auth.approle.login(role_id=vault_role_id)
 
-        if not client.is_authenticated():
-            logger.error("Failed to authenticate with Vault")
+            if not client.is_authenticated():
+                logger.error("Failed to authenticate with Vault using AppRole")
+                sys.exit(1)
+
+            logger.debug("Successfully authenticated with Vault using AppRole")
+            return client
+
+        except Exception as e:
+            logger.error(f"AppRole authentication failed: {e}")
             sys.exit(1)
 
-        logger.debug("Successfully authenticated with Vault")
-        return client
+    # Fallback to Kubernetes authentication if service account token is available
+    service_account_token_path = '/var/run/secrets/kubernetes.io/serviceaccount/token'
 
-    except Exception as e:
-        logger.error(f"Vault authentication failed: {e}")
-        sys.exit(1)
+    if os.path.exists(service_account_token_path):
+        try:
+            logger.debug(f"Attempting Kubernetes authentication to Vault at {vault_addr}")
+
+            # Read the service account token
+            with open(service_account_token_path, 'r') as f:
+                jwt_token = f.read().strip()
+
+            # Authenticate using Kubernetes auth method
+            client.auth.kubernetes.login(
+                role=vault_role,
+                jwt=jwt_token,
+                mount_point='k8s/au/syd1'
+            )
+
+            if not client.is_authenticated():
+                logger.error("Failed to authenticate with Vault using Kubernetes auth")
+                sys.exit(1)
+
+            logger.debug("Successfully authenticated with Vault using Kubernetes auth")
+            return client
+
+        except Exception as e:
+            logger.error(f"Kubernetes authentication failed: {e}")
+            sys.exit(1)
+
+    # No authentication method available
+    logger.error("Neither VAULT_ROLE_ID environment variable nor Kubernetes service account token is available")
+    sys.exit(1)
 
 
 def get_gitea_token() -> str:
@@ -570,6 +601,50 @@ def check_docker_available() -> bool:
         return False
 
 
+def check_native_build_deps() -> bool:
+    """
+    Check if native build dependencies are available (nfpm, envsubst, etc.).
+
+    Returns:
+        True if native build dependencies are available, False otherwise
+    """
+    required_commands = ['nfpm', 'envsubst', 'wget', 'tar']
+
+    for cmd in required_commands:
+        try:
+            result = subprocess.run(
+                [cmd, '--version'],
+                capture_output=True,
+                text=True,
+                timeout=5
+            )
+            if result.returncode != 0:
+                return False
+        except (subprocess.TimeoutExpired, FileNotFoundError):
+            return False
+
+    return True
+
+
+def check_buildah_available() -> bool:
+    """
+    Check if Buildah is available.
+
+    Returns:
+        True if Buildah is available, False otherwise
+    """
+    try:
+        result = subprocess.run(
+            ['buildah', 'version'],
+            capture_output=True,
+            text=True,
+            timeout=10
+        )
+        return result.returncode == 0
+    except (subprocess.TimeoutExpired, FileNotFoundError):
+        return False
+
+
 def cleanup_container(container_name: str) -> None:
     """
     Remove a Docker container.
@@ -694,6 +769,7 @@ def build_package_docker(
         build_args = [
             'docker', 'build',
             '--pull',
+            '--network=host',
             '-f', str(central_dockerfile),
             '--build-arg', f'BASE_IMAGE={base_image}',
             '--build-arg', f'PACKAGE_NAME={package_name}',
@@ -726,6 +802,7 @@ def build_package_docker(
         # Step 2: Create and start container
         create_args = [
             'docker', 'create',
+            '--network=host',
             '--name', container_name,
             image_name
         ]
@@ -777,6 +854,302 @@ def build_package_docker(
         return False
 
 
+def build_package_native(
+    package_dir: Path,
+    package_name: str,
+    package_version: str,
+    package_release: str,
+    dist_dir: Path,
+    repository: str,
+    dry_run: bool = False
+) -> bool:
+    """
+    Build a package natively without Docker, running build scripts directly.
+
+    Args:
+        package_dir: Directory containing the package resources
+        package_name: Name of the package
+        package_version: Package version
+        package_release: Package release number
+        dist_dir: Directory to store built packages
+        repository: Repository path (e.g., 'almalinux/el9')
+        dry_run: If True, only show what would be done
+
+    Returns:
+        True if build succeeded, False otherwise
+    """
+    logger = logging.getLogger(__name__)
+
+    try:
+        # Ensure dist directory exists with repository structure
+        package_dist_dir = dist_dir / repository
+        if not dry_run:
+            package_dist_dir.mkdir(parents=True, exist_ok=True)
+
+        # Create a temporary workspace for native build
+        import tempfile
+        with tempfile.TemporaryDirectory() as temp_dir:
+            temp_path = Path(temp_dir)
+            app_dir = temp_path / "app"
+            app_dist_dir = app_dir / "dist"
+
+            # Create directories
+            if not dry_run:
+                app_dir.mkdir(parents=True, exist_ok=True)
+                app_dist_dir.mkdir(parents=True, exist_ok=True)
+
+            # Copy package resources to temp directory
+            import shutil
+            temp_resources_dir = app_dir / "resources"
+            if not dry_run:
+                shutil.copytree(package_dir / "resources", temp_resources_dir)
+
+            # Read metadata.yaml to get all package fields
+            metadata_file = package_dir / "metadata.yaml"
+            metadata = {}
+            if metadata_file.exists():
+                try:
+                    with open(metadata_file, 'r') as f:
+                        metadata = yaml.safe_load(f) or {}
+                except Exception as e:
+                    logger.warning(f"Could not read metadata.yaml: {e}")
+
+            logger.info(f"Building RPM for {package_name} version {package_version} natively")
+
+            if dry_run:
+                logger.info(f"[DRY RUN] Would build natively from: {temp_path}")
+                logger.info("[DRY RUN] Would set environment variables:")
+                logger.info(f"[DRY RUN]   PACKAGE_NAME={package_name}")
+                logger.info(f"[DRY RUN]   PACKAGE_VERSION={package_version}")
+                logger.info(f"[DRY RUN]   PACKAGE_RELEASE={package_release}")
+                logger.info(f"[DRY RUN]   PACKAGE_DESCRIPTION={metadata.get('description', '')}")
+                logger.info(f"[DRY RUN] Would run: {temp_resources_dir / 'build.sh'}")
+                logger.info(f"[DRY RUN] Would copy artifacts to: {package_dist_dir}")
+                return True
+
+            # Set up environment variables like the Dockerfile does
+            build_env = os.environ.copy()
+            build_env.update({
+                'PACKAGE_NAME': package_name,
+                'PACKAGE_VERSION': package_version,
+                'PACKAGE_RELEASE': package_release,
+                'PACKAGE_DESCRIPTION': metadata.get('description', ''),
+                'PACKAGE_MAINTAINER': metadata.get('maintainer', ''),
+                'PACKAGE_HOMEPAGE': metadata.get('homepage', ''),
+                'PACKAGE_LICENSE': metadata.get('license', ''),
+                'PACKAGE_ARCH': metadata.get('arch', 'amd64'),
+                'PACKAGE_PLATFORM': metadata.get('platform', 'linux')
+            })
+
+            # Run the build script
+            build_script = temp_resources_dir / "build.sh"
+            if not build_script.exists():
+                logger.error(f"Build script not found: {build_script}")
+                return False
+
+            # Make build script executable
+            build_script.chmod(0o755)
+
+            logger.debug(f"Running build script: {build_script}")
+            result = subprocess.run(
+                [str(build_script)],
+                cwd=app_dir,
+                env=build_env,
+                capture_output=True,
+                text=True
+            )
+
+            if result.returncode != 0:
+                logger.error(f"Native build failed for {package_name}")
+                logger.error(f"stdout: {result.stdout}")
+                logger.error(f"stderr: {result.stderr}")
+                return False
+
+            # Copy artifacts to final destination
+            if app_dist_dir.exists():
+                for item in app_dist_dir.iterdir():
+                    if item.is_file():
+                        shutil.copy2(item, package_dist_dir)
+
+            logger.info(f"Successfully built {package_name}-{package_version}-{package_release} natively")
+            return True
+
+    except Exception as e:
+        logger.error(f"Unexpected error building {package_name} natively: {e}")
+        return False
+
+
+def build_package_buildah(
+    package_dir: Path,
+    package_name: str,
+    package_version: str,
+    package_release: str,
+    dist_dir: Path,
+    repository: str,
+    base_image: str = "git.unkin.net/unkin/almalinux9-rpmbuilder:latest",
+    dry_run: bool = False
+) -> bool:
+    """
+    Build a package using Buildah without Docker daemon.
+
+    Args:
+        package_dir: Directory containing the package resources
+        package_name: Name of the package
+        package_version: Package version
+        package_release: Package release number
+        dist_dir: Directory to store built packages
+        repository: Repository path (e.g., 'almalinux/el9')
+        base_image: Base Docker image to use for building
+        dry_run: If True, only show what would be done
+
+    Returns:
+        True if build succeeded, False otherwise
+    """
+    logger = logging.getLogger(__name__)
+
+    try:
+        # Ensure dist directory exists with repository structure
+        package_dist_dir = dist_dir / repository
+        if not dry_run:
+            package_dist_dir.mkdir(parents=True, exist_ok=True)
+
+        # Generate container name
+        container_name = f"{package_name}-{package_version}-buildah"
+
+        # Read metadata.yaml to get all package fields
+        metadata_file = package_dir / "metadata.yaml"
+        metadata = {}
+        if metadata_file.exists():
+            try:
+                with open(metadata_file, 'r') as f:
+                    metadata = yaml.safe_load(f) or {}
+            except Exception as e:
+                logger.warning(f"Could not read metadata.yaml: {e}")
+
+        logger.info(f"Building RPM for {package_name} version {package_version} using Buildah")
+
+        if dry_run:
+            logger.info(f"[DRY RUN] Would use Buildah to build from: {base_image}")
+            logger.info("[DRY RUN] Would set environment variables:")
+            logger.info(f"[DRY RUN]   PACKAGE_NAME={package_name}")
+            logger.info(f"[DRY RUN]   PACKAGE_VERSION={package_version}")
+            logger.info(f"[DRY RUN]   PACKAGE_RELEASE={package_release}")
+            logger.info(f"[DRY RUN] Would copy artifacts to: {package_dist_dir}")
+            return True
+
+        try:
+            # Step 1: Create a working container from base image
+            from_args = ['buildah', 'from', '--name', container_name, base_image]
+            logger.debug(f"Running: {' '.join(from_args)}")
+            result = subprocess.run(from_args, capture_output=True, text=True)
+
+            if result.returncode != 0:
+                logger.error(f"Failed to create Buildah container from {base_image}")
+                logger.error(f"stderr: {result.stderr}")
+                return False
+
+            # Step 2: Set environment variables
+            env_vars = {
+                'PACKAGE_NAME': package_name,
+                'PACKAGE_VERSION': package_version,
+                'PACKAGE_RELEASE': package_release,
+                'PACKAGE_DESCRIPTION': metadata.get('description', ''),
+                'PACKAGE_MAINTAINER': metadata.get('maintainer', ''),
+                'PACKAGE_HOMEPAGE': metadata.get('homepage', ''),
+                'PACKAGE_LICENSE': metadata.get('license', ''),
+                'PACKAGE_ARCH': metadata.get('arch', 'amd64'),
+                'PACKAGE_PLATFORM': metadata.get('platform', 'linux')
+            }
+
+            for key, value in env_vars.items():
+                config_args = ['buildah', 'config', '--env', f'{key}={value}', container_name]
+                logger.debug(f"Running: {' '.join(config_args)}")
+                result = subprocess.run(config_args, capture_output=True, text=True)
+                if result.returncode != 0:
+                    logger.error(f"Failed to set environment variable {key}")
+                    return False
+
+            # Step 3: Copy resources to container
+            copy_args = [
+                'buildah', 'copy', container_name,
+                str(package_dir / "resources"), '/app/resources'
+            ]
+            logger.debug(f"Running: {' '.join(copy_args)}")
+            result = subprocess.run(copy_args, capture_output=True, text=True)
+
+            if result.returncode != 0:
+                logger.error(f"Failed to copy resources to container")
+                logger.error(f"stderr: {result.stderr}")
+                return False
+
+            # Step 4: Create dist directory in container
+            run_args = ['buildah', 'run', container_name, 'mkdir', '-p', '/app/dist']
+            logger.debug(f"Running: {' '.join(run_args)}")
+            result = subprocess.run(run_args, capture_output=True, text=True)
+
+            # Step 5: Run the build script
+            run_args = ['buildah', 'run', '--workingdir', '/app', container_name, '/app/resources/build.sh']
+            logger.debug(f"Running: {' '.join(run_args)}")
+            result = subprocess.run(run_args, capture_output=True, text=True)
+
+            if result.returncode != 0:
+                logger.error(f"Buildah build script failed for {package_name}")
+                logger.error(f"stdout: {result.stdout}")
+                logger.error(f"stderr: {result.stderr}")
+                return False
+
+            # Step 6: Copy artifacts from container to host
+            copy_out_args = [
+                'buildah', 'run', container_name,
+                'find', '/app/dist', '-type', 'f', '-name', '*.rpm'
+            ]
+            result = subprocess.run(copy_out_args, capture_output=True, text=True)
+            logger.debug(f"Find RPMs result: {result.stdout}")
+
+            if result.returncode == 0 and result.stdout.strip():
+                rpm_files = result.stdout.strip().split('\n')
+                logger.info(f"Found {len(rpm_files)} RPM files to copy")
+
+                for rpm_file in rpm_files:
+                    rpm_file = rpm_file.strip()
+                    if rpm_file:
+                        # Use buildah mount to copy files out
+                        mount_args = ['buildah', 'mount', container_name]
+                        mount_result = subprocess.run(mount_args, capture_output=True, text=True)
+
+                        if mount_result.returncode == 0:
+                            container_path = mount_result.stdout.strip()
+                            source_file = Path(container_path) / rpm_file.lstrip('/')
+
+                            if source_file.exists():
+                                import shutil
+                                dest_file = package_dist_dir / source_file.name
+                                shutil.copy2(source_file, dest_file)
+                                logger.debug(f"Copied {source_file} to {dest_file}")
+                            else:
+                                logger.error(f"Source file not found: {source_file}")
+
+                            # Unmount
+                            subprocess.run(['buildah', 'unmount', container_name], capture_output=True)
+                        else:
+                            logger.error(f"Failed to mount container: {mount_result.stderr}")
+            else:
+                logger.warning(f"No RPM files found or find command failed: {result.stderr}")
+
+            logger.info(f"Successfully built {package_name}-{package_version}-{package_release} using Buildah")
+            return True
+
+        finally:
+            # Step 7: Clean up container
+            rm_args = ['buildah', 'rm', container_name]
+            logger.debug(f"Running: {' '.join(rm_args)}")
+            subprocess.run(rm_args, capture_output=True, text=True)
+
+    except Exception as e:
+        logger.error(f"Unexpected error building {package_name} with Buildah: {e}")
+        return False
+
+
 def cleanup_images(image_pattern: str = "*-builder") -> None:
     """
     Clean up Docker images matching a pattern.
@@ -917,7 +1290,9 @@ class Builder:
         release: str,
         dry_run: bool = False,
         force: bool = False,
-        distro: str = 'almalinux/el9'
+        distro: str = 'almalinux/el9',
+        native: bool = False,
+        buildah: bool = False
     ) -> bool:
         """
         Build a single package.
@@ -993,9 +1368,9 @@ class Builder:
             return False
 
         package_info = PackageInfo(package, version, release, package_dir, distro, base_image)
-        return self._build_package(package_info, dry_run, force)
+        return self._build_package(package_info, dry_run, force, native, buildah)
 
-    def build_all(self, dry_run: bool = False, force: bool = False, parallel: int = 4, distro: str = 'el/9') -> bool:
+    def build_all(self, dry_run: bool = False, force: bool = False, parallel: int = 4, distro: str = 'el/9', native: bool = False, buildah: bool = False) -> bool:
         """
         Build all packages.
 
@@ -1017,29 +1392,29 @@ class Builder:
         self.logger.info(f"Found {len(packages)} packages to process")
 
         if parallel == 1:
-            return self._build_sequential(packages, dry_run, force)
+            return self._build_sequential(packages, dry_run, force, native, buildah)
         else:
-            return self._build_parallel(packages, dry_run, force, parallel)
+            return self._build_parallel(packages, dry_run, force, parallel, native, buildah)
 
-    def _build_sequential(self, packages: List[PackageInfo], dry_run: bool, force: bool) -> bool:
+    def _build_sequential(self, packages: List[PackageInfo], dry_run: bool, force: bool, native: bool, buildah: bool) -> bool:
         """Build packages sequentially."""
         success_count = 0
 
         for package_info in packages:
-            if self._build_package(package_info, dry_run, force):
+            if self._build_package(package_info, dry_run, force, native, buildah):
                 success_count += 1
 
         self.logger.info(f"Built {success_count}/{len(packages)} packages successfully")
         return success_count == len(packages)
 
-    def _build_parallel(self, packages: List[PackageInfo], dry_run: bool, force: bool, parallel: int) -> bool:
+    def _build_parallel(self, packages: List[PackageInfo], dry_run: bool, force: bool, parallel: int, native: bool, buildah: bool) -> bool:
         """Build packages in parallel."""
         success_count = 0
 
         with ThreadPoolExecutor(max_workers=parallel) as executor:
             # Submit all build tasks
             future_to_package = {
-                executor.submit(self._build_package, pkg, dry_run, force): pkg
+                executor.submit(self._build_package, pkg, dry_run, force, native, buildah): pkg
                 for pkg in packages
             }
 
@@ -1056,7 +1431,7 @@ class Builder:
         self.logger.info(f"Built {success_count}/{len(packages)} packages successfully")
         return success_count == len(packages)
 
-    def _build_package(self, package_info: PackageInfo, dry_run: bool, force: bool) -> bool:
+    def _build_package(self, package_info: PackageInfo, dry_run: bool, force: bool, native: bool = False, buildah: bool = False) -> bool:
         """
         Build a single package.
 
@@ -1081,22 +1456,55 @@ class Builder:
                     )
                     return True
 
-            # Check Docker is available (unless dry run)
-            if not dry_run and not check_docker_available():
-                self.logger.error("Docker is not available or running")
+            # Check build tool availability (unless dry run)
+            use_native = native
+            use_buildah = buildah
+            use_docker = not use_native and not use_buildah and check_docker_available()
+            if not use_native and not use_buildah and not use_docker:
+                use_buildah = check_buildah_available()
+            if not use_native and not use_buildah and not use_docker:
+                use_native = check_native_build_deps()
+
+            if not dry_run and not use_native and not use_buildah and not use_docker:
+                self.logger.error("No build tools available (tried native, Buildah, Docker)")
                 return False
 
-            # Build the package
-            return build_package_docker(
-                package_dir=package_info.directory,
-                package_name=package_info.name,
-                package_version=package_info.version,
-                package_release=package_info.release,
-                dist_dir=self.dist_dir,
-                repository=package_info.distro,
-                base_image=package_info.base_image,
-                dry_run=dry_run
-            )
+            # Build the package using available tool
+            if use_native:
+                self.logger.debug(f"Using native build for {package_info.name}")
+                return build_package_native(
+                    package_dir=package_info.directory,
+                    package_name=package_info.name,
+                    package_version=package_info.version,
+                    package_release=package_info.release,
+                    dist_dir=self.dist_dir,
+                    repository=package_info.distro,
+                    dry_run=dry_run
+                )
+            elif use_buildah:
+                self.logger.debug(f"Using Buildah to build {package_info.name}")
+                return build_package_buildah(
+                    package_dir=package_info.directory,
+                    package_name=package_info.name,
+                    package_version=package_info.version,
+                    package_release=package_info.release,
+                    dist_dir=self.dist_dir,
+                    repository=package_info.distro,
+                    base_image=package_info.base_image,
+                    dry_run=dry_run
+                )
+            else:
+                self.logger.debug(f"Using Docker to build {package_info.name}")
+                return build_package_docker(
+                    package_dir=package_info.directory,
+                    package_name=package_info.name,
+                    package_version=package_info.version,
+                    package_release=package_info.release,
+                    dist_dir=self.dist_dir,
+                    repository=package_info.distro,
+                    base_image=package_info.base_image,
+                    dry_run=dry_run
+                )
 
         except Exception as e:
             self.logger.error(f"Failed to build {package_info}: {e}")
@@ -1358,6 +1766,8 @@ def build(
     distro: str = typer.Option("almalinux/el9", help="Target distro (default: almalinux/el9)"),
     dry_run: bool = typer.Option(False, "--dry-run", help="Show what would be built without building"),
     force: bool = typer.Option(False, "--force", help="Build even if package exists in registry"),
+    native: bool = typer.Option(False, "--native", help="Force native build (skip Docker even if available)"),
+    buildah: bool = typer.Option(False, "--buildah", help="Force Buildah build (requires Buildah)"),
     verbose: bool = typer.Option(False, "--verbose", "-v", help="Enable verbose logging")
 ):
     """Build a specific package."""
@@ -1419,7 +1829,9 @@ def build(
             release=str(release),
             dry_run=dry_run,
             force=force,
-            distro=distro
+            distro=distro,
+            native=native,
+            buildah=buildah
         )
 
         if not success:
@@ -1435,6 +1847,8 @@ def build_all(
     force: bool = typer.Option(False, "--force", help="Build even if packages exist in registry"),
     parallel: int = typer.Option(4, help="Number of parallel builds"),
     distro: str = typer.Option("almalinux/el9", help="Target distro (almalinux/el8, almalinux/el9, or 'all' for all distros)"),
+    native: bool = typer.Option(False, "--native", help="Force native build (skip Docker even if available)"),
+    buildah: bool = typer.Option(False, "--buildah", help="Force Buildah build (requires Buildah)"),
     verbose: bool = typer.Option(False, "--verbose", "-v", help="Enable verbose logging")
 ):
     """Build all packages."""
@@ -1448,7 +1862,9 @@ def build_all(
             dry_run=dry_run,
             force=force,
             parallel=parallel,
-            distro=distro
+            distro=distro,
+            native=native,
+            buildah=buildah
         )
 
         if not success:

tools/update-gh

@@ -154,6 +154,33 @@ def load_env_vars(env_file: Path) -> Dict[str, str]:
     return env_vars
 
 
+def get_claude_ai_latest_version() -> Optional[str]:
+    """
+    Get the latest claude-code version from downloads.claude.ai.
+
+    Returns:
+        Latest version string or None if not found
+    """
+    logger = logging.getLogger(__name__)
+
+    try:
+        url = "https://downloads.claude.ai/claude-code-releases/latest"
+        logger.debug(f"Checking claude-code latest version: {url}")
+        response = requests.get(url, timeout=30)
+
+        if response.status_code == 200:
+            version = response.text.strip()
+            logger.debug(f"Latest claude-code version: {version}")
+            return version
+        else:
+            logger.warning(f"Unexpected response from claude.ai: {response.status_code}")
+            return None
+
+    except requests.RequestException as e:
+        logger.error(f"Failed to check claude-code version: {e}")
+        return None
+
+
 def get_github_latest_release(repo: str) -> Optional[Dict]:
     """
     Get the latest release from GitHub API.
@@ -315,26 +342,30 @@ def check_package_updates(package_dir: Path, dry_run: bool = False) -> bool:
         package_name = metadata.get('name', package_dir.name)
         current_version = metadata.get('version')
         github_repo = metadata.get('github')
+        claude_ai = metadata.get('claude_ai', False)
 
-        if not github_repo:
-            logger.debug(f"Package {package_name} has no GitHub repo configured")
+        if not github_repo and not claude_ai:
+            logger.debug(f"Package {package_name} has no GitHub repo or claude_ai configured")
             return True
 
         if not current_version:
             logger.warning(f"Package {package_name} has no version in metadata")
             return False
 
-        logger.info(f"Checking {package_name} (current: {current_version}) from {github_repo}")
-
-        # Get latest release from GitHub
-        latest_release = get_github_latest_release(github_repo)
-        if not latest_release:
-            return False
-
-        latest_version = normalize_version(latest_release.get('tag_name', ''))
-        if not latest_version:
-            logger.warning(f"Could not determine latest version for {package_name}")
-            return False
+        if claude_ai:
+            logger.info(f"Checking {package_name} (current: {current_version}) from downloads.claude.ai")
+            latest_version = get_claude_ai_latest_version()
+            if not latest_version:
+                return False
+        else:
+            logger.info(f"Checking {package_name} (current: {current_version}) from {github_repo}")
+            latest_release = get_github_latest_release(github_repo)
+            if not latest_release:
+                return False
+            latest_version = normalize_version(latest_release.get('tag_name', ''))
+            if not latest_version:
+                logger.warning(f"Could not determine latest version for {package_name}")
+                return False
 
         # Compare versions
         if compare_versions(current_version, latest_version):
@@ -373,7 +404,7 @@ def find_packages_with_github(rpms_dir: Path) -> List[Path]:
             with open(metadata_file, 'r') as f:
                 metadata = yaml.safe_load(f)
 
-            if metadata.get('github'):
+            if metadata.get('github') or metadata.get('claude_ai'):
                 github_packages.append(package_dir)
         except Exception:
             continue
@@ -459,4 +490,4 @@ Examples:
 
 
 if __name__ == '__main__':
-    main()
+    main()