feat: migrate to woodpeckerci

- update build tool for kubernetes auth
- update build tool for kaniko
- add woodpecker pre-commit and build jobs

.gitea/workflows/build.yaml

@@ -0,0 +1,59 @@
+name: Build
+
+on:
+  pull_request:
+  workflow_call:
+  workflow_dispatch:
+
+jobs:
+  build-8:
+    runs-on: almalinux-8
+    container:
+      image: git.unkin.net/unkin/almalinux8-actionsdind:latest
+      options: "--privileged --volume /etc/pki/tls/vault:/etc/pki/tls/vault:ro"
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v3
+
+      - name: Build Packages
+        env:
+          VAULT_ROLE_ID: ${{ secrets.RPMBUILDER_VAULT_ROLEID }}
+        run: |
+          ./tools/build build-all --distro almalinux/el8
+
+      - name: Show RPMs
+        run: |
+          find /workspace -type f -name "*.rpm"
+
+      - name: Upload Artifacts
+        uses: actions/upload-artifact@v3
+        with:
+          name: rpms-8
+          path: /workspace/unkin/rpmbuilder/dist/*/*/*.rpm
+
+  build-9:
+    runs-on: almalinux-8
+    container:
+      image: git.unkin.net/unkin/almalinux9-actionsdind:latest
+      options: "--privileged --volume /etc/pki/tls/vault:/etc/pki/tls/vault:ro"
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v3
+
+      - name: Build Packages
+        env:
+          VAULT_ROLE_ID: ${{ secrets.RPMBUILDER_VAULT_ROLEID }}
+        run: |
+          ./tools/build build-all --distro almalinux/el9
+
+      - name: Show RPMs
+        run: |
+          find /workspace -type f -name "*.rpm"
+
+      - name: Upload Artifacts
+        uses: actions/upload-artifact@v3
+        with:
+          name: rpms-9
+          path: /workspace/unkin/rpmbuilder/dist/*/*/*.rpm

.gitea/workflows/deploy.yaml

@@ -0,0 +1,66 @@
+name: Deploy
+
+on:
+  push:
+    branches:
+      - master
+  workflow_dispatch:
+
+jobs:
+  deploy-8:
+    runs-on: almalinux-8
+    container:
+      image: git.unkin.net/unkin/almalinux8-actionsdind:latest
+      options: --privileged
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v3
+
+      - name: Download Artifacts
+        run: |
+          mkdir -p /workspace/unkin/rpmbuilder/dist/almalinux/el8
+          export PREVIOUS_RUN_ID=$((GITHUB_RUN_NUMBER - 1))
+          curl -L -o /workspace/rpms.zip "https://git.unkin.net/${GITHUB_REPOSITORY}/actions/runs/${PREVIOUS_RUN_ID}/artifacts/rpms-8"
+          unzip /workspace/rpms.zip -d /workspace/unkin/rpmbuilder/dist/almalinux/el8
+
+      - name: Show RPMs
+        run: |
+          find /workspace -type f -name "*.rpm"
+
+      - name: Upload RPMs to Gitea
+        env:
+          DRONECI_PASSWORD: ${{ secrets.DRONECI_PASSWORD }}
+        run: |
+          for rpm in $(find /workspace/unkin/rpmbuilder/dist/almalinux/el8 -type f -name "*.rpm"); do
+            curl --user droneci:${{ secrets.DRONECI_PASSWORD }} --upload-file $rpm https://git.unkin.net/api/packages/unkin/rpm/almalinux/el8/upload
+          done
+
+  deploy-9:
+    runs-on: almalinux-8
+    container:
+      image: git.unkin.net/unkin/almalinux9-actionsdind:latest
+      options: --privileged
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v3
+
+      - name: Download Artifacts
+        run: |
+          mkdir -p /workspace/unkin/rpmbuilder/dist/almalinux/el9
+          export PREVIOUS_RUN_ID=$((GITHUB_RUN_NUMBER - 1))
+          curl -L -o /workspace/rpms.zip "https://git.unkin.net/${GITHUB_REPOSITORY}/actions/runs/${PREVIOUS_RUN_ID}/artifacts/rpms-9"
+          unzip /workspace/rpms.zip -d /workspace/unkin/rpmbuilder/dist/almalinux/el9
+
+      - name: Show RPMs
+        run: |
+          find /workspace -type f -name "*.rpm"
+
+      - name: Upload RPMs to Gitea
+        env:
+          DRONECI_PASSWORD: ${{ secrets.DRONECI_PASSWORD }}
+        run: |
+          for rpm in $(find /workspace/unkin/rpmbuilder/dist/almalinux/el9 -type f -name "*.rpm"); do
+            curl --user droneci:${{ secrets.DRONECI_PASSWORD }} --upload-file $rpm https://git.unkin.net/api/packages/unkin/rpm/almalinux/el9/upload
+          done

.pre-commit-config.yaml

@@ -3,24 +3,12 @@ repos:
   - repo: https://github.com/pre-commit/pre-commit-hooks
     rev: v4.5.0
     hooks:
-      - id: check-executables-have-shebangs
-      - id: check-json
-      - id: check-added-large-files
-        args: ['--maxkb=500']
-      - id: check-merge-conflict
-      - id: check-shebang-scripts-are-executable
-      - id: check-symlinks
-      - id: check-toml
+      - id: trailing-whitespace
+      - id: end-of-file-fixer
       - id: check-yaml
         args: [--allow-multiple-documents]
-      - id: detect-aws-credentials
-        args: [--allow-missing-credentials]
+      - id: check-merge-conflict
       - id: detect-private-key
-      - id: end-of-file-fixer
-      - id: forbid-new-submodules
-      - id: pretty-format-json
-      - id: trailing-whitespace
-
   - repo: https://github.com/adrienverge/yamllint.git
     rev: v1.37.1
     hooks:
@@ -30,7 +18,6 @@ repos:
             "-d {extends: relaxed, rules: {line-length: disable}}",
             "-s",
           ]
-
   - repo: https://github.com/astral-sh/ruff-pre-commit
     rev: v0.14.7
     hooks:

.woodpecker/build-almalinux8.yaml

@@ -3,18 +3,13 @@ when:
 
 steps:
   - name: build rpms
-    image: git.unkin.net/unkin/almalinux9-rpmbuilder:latest
+    image: gcr.io/kaniko-project/executor:latest
     commands:
-      - mkdir -p /woodpecker/rpms
-      - ln -s /woodpecker/rpms /workspace
-      - dnf install buildah -y
-      - ./tools/build build-all --distro almalinux/el8 --buildah
-    privileged: true
+      - ./tools/build build-all --distro almalinux/el8 --use-kaniko
     backend_options:
       kubernetes:
         serviceAccountName: default
-
   - name: show rpms
     image: git.unkin.net/unkin/almalinux8-base:latest
     commands:
-      - find /woodpecker/src/git.unkin.net/unkin/rpmbuilder/ -type f -name "*.rpm"
+      - find /workspace -type f -name "*.rpm"

.woodpecker/build-almalinux9.yaml

@@ -3,18 +3,13 @@ when:
 
 steps:
   - name: build rpms
-    image: git.unkin.net/unkin/almalinux9-rpmbuilder:latest
+    image: gcr.io/kaniko-project/executor:latest
     commands:
-      - mkdir -p /woodpecker/rpms
-      - ln -s /woodpecker/rpms /workspace
-      - dnf install buildah -y
-      - ./tools/build build-all --distro almalinux/el9 --buildah
-    privileged: true
+      - ./tools/build build-all --distro almalinux/el8 --use-kaniko
     backend_options:
       kubernetes:
         serviceAccountName: default
-
   - name: show rpms
-    image: git.unkin.net/unkin/almalinux9-base:latest
+    image: git.unkin.net/unkin/almalinux8-base:latest
     commands:
-      - find /woodpecker/src/git.unkin.net/unkin/rpmbuilder/ -type f -name "*.rpm"
+      - find /workspace -type f -name "*.rpm"

.woodpecker/deploy-almalinux8.yaml

@@ -1,37 +0,0 @@
-when:
-  - event: push
-    branch: master
-
-steps:
-  - name: build-rpms
-    image: git.unkin.net/unkin/almalinux9-rpmbuilder:latest
-    commands:
-      - mkdir -p /woodpecker/rpms
-      - ln -s /woodpecker/rpms /workspace
-      - dnf install buildah -y
-      - ./tools/build build-all --distro almalinux/el8 --buildah
-    privileged: true
-    backend_options:
-      kubernetes:
-        serviceAccountName: default
-
-  - name: show-rpms
-    image: git.unkin.net/unkin/almalinux9-base:latest
-    commands:
-      - find /woodpecker/src/git.unkin.net/unkin/rpmbuilder/ -type f -name "*.rpm"
-    depends_on: [build-rpms]
-
-  - name: deploy-rpms
-    image: git.unkin.net/unkin/almalinux9-rpmbuilder:latest
-    commands:
-      - |
-        for rpm in $(find /woodpecker/src/git.unkin.net/unkin/rpmbuilder/ -type f -name "*.rpm"); do
-          curl --user droneci:$${DRONECI_PASSWORD} --upload-file $rpm https://git.unkin.net/api/packages/unkin/rpm/almalinux/el8/upload
-        done
-    environment:
-      DRONECI_PASSWORD:
-        from_secret: DRONECI_PASSWORD
-    backend_options:
-      kubernetes:
-        serviceAccountName: default
-    depends_on: [build-rpms, show-rpms]

.woodpecker/deploy-almalinux9.yaml

@@ -1,37 +0,0 @@
-when:
-  - event: push
-    branch: master
-
-steps:
-  - name: build-rpms
-    image: git.unkin.net/unkin/almalinux9-rpmbuilder:latest
-    commands:
-      - mkdir -p /woodpecker/rpms
-      - ln -s /woodpecker/rpms /workspace
-      - dnf install buildah -y
-      - ./tools/build build-all --distro almalinux/el9 --buildah
-    privileged: true
-    backend_options:
-      kubernetes:
-        serviceAccountName: default
-
-  - name: show-rpms
-    image: git.unkin.net/unkin/almalinux9-base:latest
-    commands:
-      - find /woodpecker/src/git.unkin.net/unkin/rpmbuilder/ -type f -name "*.rpm"
-    depends_on: [build-rpms]
-
-  - name: deploy-rpms
-    image: git.unkin.net/unkin/almalinux9-rpmbuilder:latest
-    commands:
-      - |
-        for rpm in $(find /woodpecker/src/git.unkin.net/unkin/rpmbuilder/ -type f -name "*.rpm"); do
-          curl --user droneci:$${DRONECI_PASSWORD} --upload-file $rpm https://git.unkin.net/api/packages/unkin/rpm/almalinux/el9/upload
-        done
-    environment:
-      DRONECI_PASSWORD:
-        from_secret: DRONECI_PASSWORD
-    backend_options:
-      kubernetes:
-        serviceAccountName: default
-    depends_on: [build-rpms, show-rpms]

Dockerfile

@@ -31,4 +31,4 @@ ENV PACKAGE_PLATFORM=${PACKAGE_PLATFORM}
 COPY resources /app/resources
 
 # Default command to build RPMs
-CMD /app/resources/build.sh
+CMD /app/resources/build.sh

Makefile

@@ -26,16 +26,6 @@ build-all:
 	@echo "Building all packages using Python tooling for distro $(DISTRO)..."
 	$(BUILD_TOOL) build-all --distro $(DISTRO)
 
-# Build all packages using native build (no Docker)
-build-all-native:
-	@echo "Building all packages natively (no Docker) for distro $(DISTRO)..."
-	$(BUILD_TOOL) build-all --distro $(DISTRO) --native
-
-# Build all packages using Buildah
-build-all-buildah:
-	@echo "Building all packages using Buildah for distro $(DISTRO)..."
-	$(BUILD_TOOL) build-all --distro $(DISTRO) --buildah
-
 # Build specific package using Python tool
 .PHONY: $(PACKAGES)
 $(PACKAGES):

rpms/boilerplate/resources/build.sh

@@ -8,4 +8,4 @@ wget -O /app/boilerplate https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote
 envsubst < /app/resources/nfpm.yaml > /app/nfpm.yaml
 
 # Build the RPM
-nfpm pkg --config /app/nfpm.yaml --target /app/dist --packager rpm
+nfpm pkg --config /app/nfpm.yaml --target /app/dist --packager rpm

rpms/claude-code/metadata.yaml

@@ -1,18 +0,0 @@
----
-arch: amd64
-builds:
-  - image: git.unkin.net/unkin/almalinux8-rpmbuilder:latest
-    release: '1'
-    repository: [almalinux/el8]
-    version: 2.1.120
-  - image: git.unkin.net/unkin/almalinux9-rpmbuilder:latest
-    release: '1'
-    repository: [almalinux/el9]
-    version: 2.1.120
-claude_ai: true
-description: Claude Code - Anthropic's agentic AI coding tool
-homepage: https://claude.ai/code
-license: Proprietary
-maintainer: Anthropic
-name: claude-code
-platform: linux

rpms/claude-code/resources/build.sh

@@ -1,13 +0,0 @@
-#!/usr/bin/bash
-
-set -e
-
-# Download claude-code binary
-wget -O /app/claude https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/claude-ai/claude-code-releases/${PACKAGE_VERSION}/linux-x64/claude
-chmod +x /app/claude
-
-# Process the nfpm.yaml template with environment variables
-envsubst < /app/resources/nfpm.yaml > /app/nfpm.yaml
-
-# Build the RPM
-nfpm pkg --config /app/nfpm.yaml --target /app/dist --packager rpm

rpms/claude-code/resources/nfpm.yaml

@@ -1,33 +0,0 @@
-# nfpm.yaml
-
-name: ${PACKAGE_NAME}
-version: ${PACKAGE_VERSION}
-release: ${PACKAGE_RELEASE}
-arch: ${PACKAGE_ARCH}
-platform: ${PACKAGE_PLATFORM}
-section: default
-priority: extra
-description: "${PACKAGE_DESCRIPTION}"
-
-maintainer: ${PACKAGE_MAINTAINER}
-homepage: ${PACKAGE_HOMEPAGE}
-license: ${PACKAGE_LICENSE}
-
-disable_globbing: false
-
-replaces:
-  - claude-code
-  - claude
-
-provides:
-  - claude-code
-  - claude
-
-# Files to include in the package
-contents:
-  - src: /app/claude
-    dst: /usr/bin/claude
-    file_info:
-      mode: 0755
-      owner: root
-      group: root

rpms/cni-plugins/resources/build.sh

@@ -9,4 +9,4 @@ tar xf cni-plugins-linux-amd64.tgz
 envsubst < /app/resources/nfpm.yaml > /app/nfpm.yaml
 
 # Build the RPM
-nfpm pkg --config /app/nfpm.yaml --target /app/dist --packager rpm
+nfpm pkg --config /app/nfpm.yaml --target /app/dist --packager rpm

rpms/consul-cni/resources/build.sh

@@ -12,4 +12,4 @@ unzip consul-cni.zip
 # Process the nfpm.yaml template with environment variables
 envsubst < /app/resources/nfpm.yaml > /app/nfpm.yaml
 
-nfpm pkg --config /app/nfpm.yaml --target /app/dist --packager rpm
+nfpm pkg --config /app/nfpm.yaml --target /app/dist --packager rpm

rpms/consul/resources/build.sh

@@ -13,4 +13,4 @@ unzip consul.zip
 envsubst < /app/resources/nfpm.yaml > /app/nfpm.yaml
 
 # Build the RPM
-nfpm pkg --config /app/nfpm.yaml --target /app/dist --packager rpm
+nfpm pkg --config /app/nfpm.yaml --target /app/dist --packager rpm

rpms/etcd/resources/build.sh

@@ -10,4 +10,4 @@ mv /app/etcd-v${PACKAGE_VERSION}-linux-amd64/* /app/
 envsubst < /app/resources/nfpm.yaml > /app/nfpm.yaml
 
 # Build the RPM
-nfpm pkg --config /app/nfpm.yaml --target /app/dist --packager rpm
+nfpm pkg --config /app/nfpm.yaml --target /app/dist --packager rpm

rpms/g10k/resources/build.sh

@@ -11,4 +11,4 @@ popd
 envsubst < /app/resources/nfpm.yaml > /app/nfpm.yaml
 
 # Build the RPM
-nfpm pkg --config /app/nfpm.yaml --target /app/dist --packager rpm
+nfpm pkg --config /app/nfpm.yaml --target /app/dist --packager rpm

rpms/helmfile/resources/build.sh

@@ -15,4 +15,4 @@ chmod +x /app/helmfile
 # Process the nfpm.yaml template with environment variables
 envsubst < /app/resources/nfpm.yaml > /app/nfpm.yaml
 
-nfpm pkg --config /app/nfpm.yaml --target /app/dist --packager rpm
+nfpm pkg --config /app/nfpm.yaml --target /app/dist --packager rpm

rpms/jellyfin-ffmpeg-bin/resources/build.sh

@@ -14,4 +14,4 @@ rpmbuild -ba /root/rpmbuild/SPECS/jellyfin-ffmpeg-bin.spec
 
 # Copy the built RPMs to output directory
 cp /root/rpmbuild/RPMS/x86_64/jellyfin-ffmpeg-bin-*.rpm /app/dist/
-cp /root/rpmbuild/SRPMS/jellyfin-ffmpeg-bin-*.rpm /app/dist
+cp /root/rpmbuild/SRPMS/jellyfin-ffmpeg-bin-*.rpm /app/dist

rpms/jellyfin-server/resources/build.sh

@@ -18,4 +18,4 @@ rpmbuild -ba /app/resources/jellyfin-server_${PACKAGE_VERSION}.spec
 
 # Copy the built RPMs to output directory
 cp /root/rpmbuild/RPMS/x86_64/jellyfin-server-${PACKAGE_VERSION}-${PACKAGE_RELEASE}.x86_64.rpm /app/dist/
-cp /root/rpmbuild/SRPMS/jellyfin-server-${PACKAGE_VERSION}-${PACKAGE_RELEASE}.src.rpm /app/dist/
+cp /root/rpmbuild/SRPMS/jellyfin-server-${PACKAGE_VERSION}-${PACKAGE_RELEASE}.src.rpm /app/dist/

rpms/jellyfin-web/resources/build.sh

@@ -15,4 +15,4 @@ rpmbuild -ba /app/resources/jellyfin-web_${PACKAGE_VERSION}.spec
 
 # Copy the built RPMs to output directory
 cp /root/rpmbuild/RPMS/noarch/jellyfin-web-${PACKAGE_VERSION}-${PACKAGE_RELEASE}.noarch.rpm /app/dist/
-cp /root/rpmbuild/SRPMS/jellyfin-web-${PACKAGE_VERSION}-${PACKAGE_RELEASE}.src.rpm /app/dist/
+cp /root/rpmbuild/SRPMS/jellyfin-web-${PACKAGE_VERSION}-${PACKAGE_RELEASE}.src.rpm /app/dist/

rpms/jsonnet-language-server/resources/build.sh

@@ -11,4 +11,4 @@ chmod +x /app/jsonnet-language-server
 # Process the nfpm.yaml template with environment variables
 envsubst < /app/resources/nfpm.yaml > /app/nfpm.yaml
 
-nfpm pkg --config /app/nfpm.yaml --target /app/dist --packager rpm
+nfpm pkg --config /app/nfpm.yaml --target /app/dist --packager rpm

rpms/jsonnet-lint/resources/build.sh

@@ -20,4 +20,4 @@ GOBIN=/app go install github.com/google/go-jsonnet/cmd/jsonnet-lint@v${PACKAGE_V
 envsubst < /app/resources/nfpm.yaml > /app/nfpm.yaml
 
 # Build RPM package
-nfpm pkg --config /app/nfpm.yaml --target /app/dist --packager rpm
+nfpm pkg --config /app/nfpm.yaml --target /app/dist --packager rpm

rpms/jsonnet/resources/build.sh

@@ -21,4 +21,4 @@ GOBIN=/app go install github.com/google/go-jsonnet/cmd/jsonnetfmt@v${PACKAGE_VER
 envsubst < /app/resources/nfpm.yaml > /app/nfpm.yaml
 
 # Build RPM package
-nfpm pkg --config /app/nfpm.yaml --target /app/dist --packager rpm
+nfpm pkg --config /app/nfpm.yaml --target /app/dist --packager rpm

rpms/kubeconform/resources/build.sh

@@ -11,4 +11,4 @@ tar -xzf /app/kubeconform-linux-amd64.tar.gz -C /app/
 envsubst < /app/resources/nfpm.yaml > /app/nfpm.yaml
 
 # Build the RPM
-nfpm pkg --config /app/nfpm.yaml --target /app/dist --packager rpm
+nfpm pkg --config /app/nfpm.yaml --target /app/dist --packager rpm

rpms/libfoundationdb/resources/build.sh

@@ -11,4 +11,4 @@ chmod 755 /app/libfdb_c.so
 # Process the nfpm.yaml template with environment variables
 envsubst < /app/resources/nfpm.yaml > /app/nfpm.yaml
 
-nfpm pkg --config /app/nfpm.yaml --target /app/dist --packager rpm
+nfpm pkg --config /app/nfpm.yaml --target /app/dist --packager rpm

rpms/libfoundationdb/resources/scripts/postinstall.sh

@@ -1,4 +1,4 @@
 #!/usr/bin/env bash
 
 # Update the dynamic linker cache to include the new library
-ldconfig
+ldconfig

rpms/nfpm/resources/build.sh

@@ -11,4 +11,4 @@ GOBIN=/app go install github.com/goreleaser/nfpm/v2/cmd/nfpm@v${PACKAGE_VERSION}
 envsubst < /app/resources/nfpm.yaml > /app/nfpm.yaml
 
 # Build the RPM
-nfpm pkg --config /app/nfpm.yaml --target /app/dist --packager rpm
+nfpm pkg --config /app/nfpm.yaml --target /app/dist --packager rpm

rpms/nomad-autoscaler/resources/build.sh

@@ -12,4 +12,4 @@ unzip nomad-autoscaler.zip
 # Process the nfpm.yaml template with environment variables
 envsubst < /app/resources/nfpm.yaml > /app/nfpm.yaml
 
-nfpm pkg --config /app/nfpm.yaml --target /app/dist --packager rpm
+nfpm pkg --config /app/nfpm.yaml --target /app/dist --packager rpm

rpms/nomad/resources/build.sh

@@ -12,4 +12,4 @@ unzip nomad.zip
 # Process the nfpm.yaml template with environment variables
 envsubst < /app/resources/nfpm.yaml > /app/nfpm.yaml
 
-nfpm pkg --config /app/nfpm.yaml --target /app/dist --packager rpm
+nfpm pkg --config /app/nfpm.yaml --target /app/dist --packager rpm

rpms/nzbget/resources/build.sh

@@ -4,4 +4,4 @@ set -e
 
 # Download the pre-built RPM from GitHub releases
 curl -L -o /app/dist/nzbget-${PACKAGE_VERSION}-${PACKAGE_RELEASE}.x86_64.rpm \
-  https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/github/nzbgetcom/nzbget/releases/download/v$PACKAGE_VERSION/nzbget-${PACKAGE_VERSION}-${PACKAGE_RELEASE}.x86_64.rpm
+  https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/github/nzbgetcom/nzbget/releases/download/v$PACKAGE_VERSION/nzbget-${PACKAGE_VERSION}-${PACKAGE_RELEASE}.x86_64.rpm

rpms/openbao-plugin-secret-consul/resources/build.sh

@@ -17,4 +17,4 @@ chmod +x /app/openbao-plugin-secrets-consul
 # Process the nfpm.yaml template with environment variables
 envsubst < /app/resources/nfpm.yaml > /app/nfpm.yaml
 
-nfpm pkg --config /app/nfpm.yaml --target /app/dist --packager rpm
+nfpm pkg --config /app/nfpm.yaml --target /app/dist --packager rpm

rpms/openbao-plugin-secret-consul/resources/scripts/preinstall.sh

@@ -1,2 +1,2 @@
 #!/usr/bin/env bash
-mkdir -p /opt/openbao-plugins
+mkdir -p /opt/openbao-plugins

rpms/openbao-plugin-secret-nomad/resources/build.sh

@@ -17,4 +17,4 @@ chmod +x /app/openbao-plugin-secrets-nomad
 # Process the nfpm.yaml template with environment variables
 envsubst < /app/resources/nfpm.yaml > /app/nfpm.yaml
 
-nfpm pkg --config /app/nfpm.yaml --target /app/dist --packager rpm
+nfpm pkg --config /app/nfpm.yaml --target /app/dist --packager rpm

rpms/openbao-plugin-secret-nomad/resources/scripts/preinstall.sh

@@ -1,2 +1,2 @@
 #!/usr/bin/env bash
-mkdir -p /opt/openbao-plugins
+mkdir -p /opt/openbao-plugins

rpms/openbao-plugins/resources/build.sh

@@ -7,4 +7,4 @@ set -e
 envsubst < /app/resources/nfpm.yaml > /app/nfpm.yaml
 
 # Build the RPM
-nfpm pkg --config /app/nfpm.yaml --target /app/dist --packager rpm
+nfpm pkg --config /app/nfpm.yaml --target /app/dist --packager rpm

rpms/packer/resources/build.sh

@@ -13,4 +13,4 @@ unzip packer.zip
 envsubst < /app/resources/nfpm.yaml > /app/nfpm.yaml
 
 # Build the RPM
-nfpm pkg --config /app/nfpm.yaml --target /app/dist --packager rpm
+nfpm pkg --config /app/nfpm.yaml --target /app/dist --packager rpm

rpms/ruff/resources/build.sh

@@ -11,4 +11,4 @@ mv /app/ruff-x86_64-unknown-linux-gnu/* /app/
 envsubst < /app/resources/nfpm.yaml > /app/nfpm.yaml
 
 # Build the RPM
-nfpm pkg --config /app/nfpm.yaml --target /app/dist --packager rpm
+nfpm pkg --config /app/nfpm.yaml --target /app/dist --packager rpm

rpms/stalwart-cli/resources/build.sh

@@ -14,4 +14,4 @@ chmod +x /app/stalwart-cli
 # Process the nfpm.yaml template with environment variables
 envsubst < /app/resources/nfpm.yaml > /app/nfpm.yaml
 
-nfpm pkg --config /app/nfpm.yaml --target /app/dist --packager rpm
+nfpm pkg --config /app/nfpm.yaml --target /app/dist --packager rpm

rpms/stalwart-foundationdb/resources/build.sh

@@ -14,4 +14,4 @@ chmod +x /app/stalwart-foundationdb
 # Process the nfpm.yaml template with environment variables
 envsubst < /app/resources/nfpm.yaml > /app/nfpm.yaml
 
-nfpm pkg --config /app/nfpm.yaml --target /app/dist --packager rpm
+nfpm pkg --config /app/nfpm.yaml --target /app/dist --packager rpm

rpms/stalwart-foundationdb/resources/scripts/postremove.sh

@@ -4,4 +4,4 @@
 systemctl daemon-reload
 
 # Note: We don't remove user data, logs, or configuration files
-# to preserve user data in case of reinstallation
+# to preserve user data in case of reinstallation

rpms/stalwart-foundationdb/resources/scripts/preinstall.sh

@@ -17,4 +17,4 @@ mkdir -p /var/log/stalwart
 # Set ownership
 chown -R stalwart:stalwart /opt/stalwart
 chown -R stalwart:stalwart /var/lib/stalwart
-chown -R stalwart:stalwart /var/log/stalwart
+chown -R stalwart:stalwart /var/log/stalwart

rpms/stalwart-foundationdb/resources/scripts/preremove.sh

@@ -4,4 +4,4 @@
 if systemctl is-enabled stalwart-foundationdb.service >/dev/null 2>&1; then
     systemctl stop stalwart-foundationdb.service
     systemctl disable stalwart-foundationdb.service
-fi
+fi

rpms/stalwart-foundationdb/resources/stalwart-foundationdb.service

@@ -23,4 +23,4 @@ ProtectSystem=strict
 ReadWritePaths=/var/lib/stalwart /var/log/stalwart /opt/stalwart/data
 
 [Install]
-WantedBy=multi-user.target
+WantedBy=multi-user.target

rpms/stalwart/resources/build.sh

@@ -14,4 +14,4 @@ chmod +x /app/stalwart
 # Process the nfpm.yaml template with environment variables
 envsubst < /app/resources/nfpm.yaml > /app/nfpm.yaml
 
-nfpm pkg --config /app/nfpm.yaml --target /app/dist --packager rpm
+nfpm pkg --config /app/nfpm.yaml --target /app/dist --packager rpm

rpms/stalwart/resources/scripts/postremove.sh

@@ -4,4 +4,4 @@
 systemctl daemon-reload
 
 # Note: We don't remove user data, logs, or configuration files
-# to preserve user data in case of reinstallation
+# to preserve user data in case of reinstallation

rpms/stalwart/resources/scripts/preinstall.sh

@@ -17,4 +17,4 @@ mkdir -p /var/log/stalwart
 # Set ownership
 chown -R stalwart:stalwart /opt/stalwart
 chown -R stalwart:stalwart /var/lib/stalwart
-chown -R stalwart:stalwart /var/log/stalwart
+chown -R stalwart:stalwart /var/log/stalwart

rpms/stalwart/resources/scripts/preremove.sh

@@ -4,4 +4,4 @@
 if systemctl is-enabled stalwart.service >/dev/null 2>&1; then
     systemctl stop stalwart.service
     systemctl disable stalwart.service
-fi
+fi

rpms/stalwart/resources/stalwart.service

@@ -22,4 +22,4 @@ ProtectSystem=strict
 ReadWritePaths=/var/lib/stalwart /var/log/stalwart /opt/stalwart/data
 
 [Install]
-WantedBy=multi-user.target
+WantedBy=multi-user.target

rpms/stern/metadata.yaml

@@ -1,20 +0,0 @@
----
-name: stern
-github: stern/stern
-description: Multi pod and container log tailing for Kubernetes.
-arch: amd64
-platform: linux
-maintainer: stern
-homepage: https://github.com/stern/stern
-license: Apache-2.0
-builds:
-- repository:
-  - almalinux/el8
-  image: git.unkin.net/unkin/almalinux8-rpmbuilder:latest
-  release: 1
-  version: 1.33.1
-- repository:
-  - almalinux/el9
-  image: git.unkin.net/unkin/almalinux9-rpmbuilder:latest
-  release: 1
-  version: 1.33.1

rpms/stern/resources/build.sh

@@ -1,10 +0,0 @@
-#!/usr/bin/bash
-
-set -e
-
-wget -O /app/stern_${PACKAGE_VERSION}_linux_amd64.tar.gz https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/github/stern/stern/releases/download/v${PACKAGE_VERSION}/stern_${PACKAGE_VERSION}_linux_amd64.tar.gz
-tar xf /app/stern_${PACKAGE_VERSION}_linux_amd64.tar.gz
-
-envsubst < /app/resources/nfpm.yaml > /app/nfpm.yaml
-
-nfpm pkg --config /app/nfpm.yaml --target /app/dist --packager rpm

rpms/stern/resources/nfpm.yaml

@@ -1,30 +0,0 @@
-# nfpm.yaml
-
-name: ${PACKAGE_NAME}
-version: ${PACKAGE_VERSION}
-release: ${PACKAGE_RELEASE}
-arch: ${PACKAGE_ARCH}
-platform: ${PACKAGE_PLATFORM}
-section: default
-priority: extra
-description: "${PACKAGE_DESCRIPTION}"
-
-maintainer: ${PACKAGE_MAINTAINER}
-homepage: ${PACKAGE_HOMEPAGE}
-license: ${PACKAGE_LICENSE}
-
-disable_globbing: false
-
-replaces:
-  - stern
-
-provides:
-  - stern
-
-contents:
-  - src: /app/stern
-    dst: /usr/bin/stern
-    file_info:
-      mode: 0755
-      owner: root
-      group: root

rpms/tea/metadata.yaml

@@ -1,20 +0,0 @@
----
-name: tea
-github: unknown/tea
-description: The official CLI for Gitea.
-arch: amd64
-platform: linux
-maintainer: Gitea
-homepage: https://gitea.com/gitea/tea
-license: MIT
-builds:
-- repository:
-  - almalinux/el8
-  image: git.unkin.net/unkin/almalinux8-rpmbuilder:latest
-  release: 1
-  version: 0.14.0
-- repository:
-  - almalinux/el9
-  image: git.unkin.net/unkin/almalinux9-rpmbuilder:latest
-  release: 1
-  version: 0.14.0

rpms/tea/resources/build.sh

@@ -1,10 +0,0 @@
-#!/usr/bin/bash
-
-set -e
-
-curl -L --output /app/tea-linux-amd64 https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/gitea-dl/tea/${PACKAGE_VERSION}/tea-${PACKAGE_VERSION}-linux-amd64
-chmod +x /app/tea-linux-amd64
-
-envsubst < /app/resources/nfpm.yaml > /app/nfpm.yaml
-
-nfpm pkg --config /app/nfpm.yaml --target /app/dist --packager rpm

rpms/tea/resources/nfpm.yaml

@@ -1,30 +0,0 @@
-# nfpm.yaml
-
-name: ${PACKAGE_NAME}
-version: ${PACKAGE_VERSION}
-release: ${PACKAGE_RELEASE}
-arch: ${PACKAGE_ARCH}
-platform: ${PACKAGE_PLATFORM}
-section: default
-priority: extra
-description: "${PACKAGE_DESCRIPTION}"
-
-maintainer: ${PACKAGE_MAINTAINER}
-homepage: ${PACKAGE_HOMEPAGE}
-license: ${PACKAGE_LICENSE}
-
-disable_globbing: false
-
-replaces:
-  - tea
-
-provides:
-  - tea
-
-contents:
-  - src: /app/tea-linux-amd64
-    dst: /usr/bin/tea
-    file_info:
-      mode: 0755
-      owner: root
-      group: root

rpms/terraform/resources/build.sh

@@ -13,4 +13,4 @@ unzip terraform.zip
 envsubst < /app/resources/nfpm.yaml > /app/nfpm.yaml
 
 # Build the RPM
-nfpm pkg --config /app/nfpm.yaml --target /app/dist --packager rpm
+nfpm pkg --config /app/nfpm.yaml --target /app/dist --packager rpm

rpms/terragrunt/resources/build.sh

@@ -9,4 +9,4 @@ wget -O /app/terragrunt https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/
 envsubst < /app/resources/nfpm.yaml > /app/nfpm.yaml
 
 # Build the RPM
-nfpm pkg --config /app/nfpm.yaml --target /app/dist --packager rpm
+nfpm pkg --config /app/nfpm.yaml --target /app/dist --packager rpm

rpms/tflint/resources/build.sh

@@ -11,4 +11,4 @@ unzip -j /app/tflint_linux_amd64.zip -d /app/
 envsubst < /app/resources/nfpm.yaml > /app/nfpm.yaml
 
 # Build the RPM
-nfpm pkg --config /app/nfpm.yaml --target /app/dist --packager rpm
+nfpm pkg --config /app/nfpm.yaml --target /app/dist --packager rpm

rpms/unkin-ca-certificates/resources/build.sh

@@ -8,4 +8,4 @@ curl -L -o /app/UNKIN_ROOTCA_2024.crt https://vault.query.consul:8200/v1/pki_roo
 # Process the nfpm.yaml template with environment variables
 envsubst < /app/resources/nfpm.yaml > /app/nfpm.yaml
 
-nfpm pkg --config /app/nfpm.yaml --target /app/dist --packager rpm
+nfpm pkg --config /app/nfpm.yaml --target /app/dist --packager rpm

rpms/unrar/metadata.yaml

@@ -4,11 +4,11 @@ builds:
   - image: git.unkin.net/unkin/almalinux8-rpmbuilder:latest
     release: '1'
     repository: [almalinux/el8]
-    version: '7.20'
+    version: '7.12'
   - image: git.unkin.net/unkin/almalinux9-rpmbuilder:latest
     release: '1'
     repository: [almalinux/el9]
-    version: '7.20'
+    version: '7.12'
 description: WinRAR is a powerful archive manager. It can backup your data and reduce the size of email attachments, open and unpack RAR, ZIP and other files downloaded from Internet, create new archives in RAR and ZIP file format.
 github: unknown/unrar
 homepage: https://www.rarlab.com/

rpms/unrar/resources/build.sh

@@ -4,8 +4,8 @@ set -e
 
 # Download and extract unrar (with version formatting)
 export DOWNLOAD_VERSION=$(echo $PACKAGE_VERSION | sed s/\\.//)
-curl -L -o /app/rarlinux.tar.gz https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/rarlab/rar/rarlinux-x64-${DOWNLOAD_VERSION}.tar.gz
-tar xf /app/rarlinux.tar.gz -C /app
+curl -L -o /app/rarlinux.tar.gz https://www.rarlab.com/rar/rarlinux-x64-${DOWNLOAD_VERSION}.tar.gz
+tar xf /app/rarlinux.tar.gz
 mv /app/rar/unrar /app/
 
 # Process the nfpm.yaml template with environment variables

rpms/uv/resources/build.sh

@@ -11,4 +11,4 @@ mv /app/uv-x86_64-unknown-linux-gnu/* /app/
 envsubst < /app/resources/nfpm.yaml > /app/nfpm.yaml
 
 # Build the RPM
-nfpm pkg --config /app/nfpm.yaml --target /app/dist --packager rpm
+nfpm pkg --config /app/nfpm.yaml --target /app/dist --packager rpm

rpms/vals/resources/build.sh

@@ -15,4 +15,4 @@ chmod +x /app/vals
 # Process the nfpm.yaml template with environment variables
 envsubst < /app/resources/nfpm.yaml > /app/nfpm.yaml
 
-nfpm pkg --config /app/nfpm.yaml --target /app/dist --packager rpm
+nfpm pkg --config /app/nfpm.yaml --target /app/dist --packager rpm

rpms/vault/resources/build.sh

@@ -13,4 +13,4 @@ unzip vault.zip
 envsubst < /app/resources/nfpm.yaml > /app/nfpm.yaml
 
 # Build the RPM
-nfpm pkg --config /app/nfpm.yaml --target /app/dist --packager rpm
+nfpm pkg --config /app/nfpm.yaml --target /app/dist --packager rpm

rpms/victoria-logs/resources/build.sh

@@ -10,4 +10,4 @@ tar xf victoria-logs-linux-amd64-v${PACKAGE_VERSION}.tar.gz
 # Process the nfpm.yaml template with environment variables
 envsubst < /app/resources/nfpm.yaml > /app/nfpm.yaml
 
-nfpm pkg --config /app/nfpm.yaml --target /app/dist --packager rpm
+nfpm pkg --config /app/nfpm.yaml --target /app/dist --packager rpm

rpms/vlutils/resources/build.sh

@@ -10,4 +10,4 @@ tar xf vlutils-linux-amd64-v${PACKAGE_VERSION}.tar.gz
 # Process the nfpm.yaml template with environment variables
 envsubst < /app/resources/nfpm.yaml > /app/nfpm.yaml
 
-nfpm pkg --config /app/nfpm.yaml --target /app/dist --packager rpm
+nfpm pkg --config /app/nfpm.yaml --target /app/dist --packager rpm

rpms/vmutils/resources/build.sh

@@ -10,4 +10,4 @@ tar xf vmutils-linux-amd64-v${PACKAGE_VERSION}.tar.gz
 # Process the nfpm.yaml template with environment variables
 envsubst < /app/resources/nfpm.yaml > /app/nfpm.yaml
 
-nfpm pkg --config /app/nfpm.yaml --target /app/dist --packager rpm
+nfpm pkg --config /app/nfpm.yaml --target /app/dist --packager rpm

rpms/xh/resources/build.sh

@@ -11,4 +11,4 @@ mv /app/xh-v${PACKAGE_VERSION}-x86_64-unknown-linux-musl/* /app/
 envsubst < /app/resources/nfpm.yaml > /app/nfpm.yaml
 
 # Build the RPM
-nfpm pkg --config /app/nfpm.yaml --target /app/dist --packager rpm
+nfpm pkg --config /app/nfpm.yaml --target /app/dist --packager rpm

tools/build

@@ -601,41 +601,16 @@ def check_docker_available() -> bool:
         return False
 
 
-def check_native_build_deps() -> bool:
+def check_kaniko_available() -> bool:
     """
-    Check if native build dependencies are available (nfpm, envsubst, etc.).
+    Check if Kaniko executor is available.
 
     Returns:
-        True if native build dependencies are available, False otherwise
-    """
-    required_commands = ['nfpm', 'envsubst', 'wget', 'tar']
-
-    for cmd in required_commands:
-        try:
-            result = subprocess.run(
-                [cmd, '--version'],
-                capture_output=True,
-                text=True,
-                timeout=5
-            )
-            if result.returncode != 0:
-                return False
-        except (subprocess.TimeoutExpired, FileNotFoundError):
-            return False
-
-    return True
-
-
-def check_buildah_available() -> bool:
-    """
-    Check if Buildah is available.
-
-    Returns:
-        True if Buildah is available, False otherwise
+        True if Kaniko is available, False otherwise
     """
     try:
         result = subprocess.run(
-            ['buildah', 'version'],
+            ['/kaniko/executor', '--version'],
             capture_output=True,
             text=True,
             timeout=10
@@ -769,7 +744,6 @@ def build_package_docker(
         build_args = [
             'docker', 'build',
             '--pull',
-            '--network=host',
             '-f', str(central_dockerfile),
             '--build-arg', f'BASE_IMAGE={base_image}',
             '--build-arg', f'PACKAGE_NAME={package_name}',
@@ -802,7 +776,6 @@ def build_package_docker(
         # Step 2: Create and start container
         create_args = [
             'docker', 'create',
-            '--network=host',
             '--name', container_name,
             image_name
         ]
@@ -854,132 +827,7 @@ def build_package_docker(
         return False
 
 
-def build_package_native(
-    package_dir: Path,
-    package_name: str,
-    package_version: str,
-    package_release: str,
-    dist_dir: Path,
-    repository: str,
-    dry_run: bool = False
-) -> bool:
-    """
-    Build a package natively without Docker, running build scripts directly.
-
-    Args:
-        package_dir: Directory containing the package resources
-        package_name: Name of the package
-        package_version: Package version
-        package_release: Package release number
-        dist_dir: Directory to store built packages
-        repository: Repository path (e.g., 'almalinux/el9')
-        dry_run: If True, only show what would be done
-
-    Returns:
-        True if build succeeded, False otherwise
-    """
-    logger = logging.getLogger(__name__)
-
-    try:
-        # Ensure dist directory exists with repository structure
-        package_dist_dir = dist_dir / repository
-        if not dry_run:
-            package_dist_dir.mkdir(parents=True, exist_ok=True)
-
-        # Create a temporary workspace for native build
-        import tempfile
-        with tempfile.TemporaryDirectory() as temp_dir:
-            temp_path = Path(temp_dir)
-            app_dir = temp_path / "app"
-            app_dist_dir = app_dir / "dist"
-
-            # Create directories
-            if not dry_run:
-                app_dir.mkdir(parents=True, exist_ok=True)
-                app_dist_dir.mkdir(parents=True, exist_ok=True)
-
-            # Copy package resources to temp directory
-            import shutil
-            temp_resources_dir = app_dir / "resources"
-            if not dry_run:
-                shutil.copytree(package_dir / "resources", temp_resources_dir)
-
-            # Read metadata.yaml to get all package fields
-            metadata_file = package_dir / "metadata.yaml"
-            metadata = {}
-            if metadata_file.exists():
-                try:
-                    with open(metadata_file, 'r') as f:
-                        metadata = yaml.safe_load(f) or {}
-                except Exception as e:
-                    logger.warning(f"Could not read metadata.yaml: {e}")
-
-            logger.info(f"Building RPM for {package_name} version {package_version} natively")
-
-            if dry_run:
-                logger.info(f"[DRY RUN] Would build natively from: {temp_path}")
-                logger.info("[DRY RUN] Would set environment variables:")
-                logger.info(f"[DRY RUN]   PACKAGE_NAME={package_name}")
-                logger.info(f"[DRY RUN]   PACKAGE_VERSION={package_version}")
-                logger.info(f"[DRY RUN]   PACKAGE_RELEASE={package_release}")
-                logger.info(f"[DRY RUN]   PACKAGE_DESCRIPTION={metadata.get('description', '')}")
-                logger.info(f"[DRY RUN] Would run: {temp_resources_dir / 'build.sh'}")
-                logger.info(f"[DRY RUN] Would copy artifacts to: {package_dist_dir}")
-                return True
-
-            # Set up environment variables like the Dockerfile does
-            build_env = os.environ.copy()
-            build_env.update({
-                'PACKAGE_NAME': package_name,
-                'PACKAGE_VERSION': package_version,
-                'PACKAGE_RELEASE': package_release,
-                'PACKAGE_DESCRIPTION': metadata.get('description', ''),
-                'PACKAGE_MAINTAINER': metadata.get('maintainer', ''),
-                'PACKAGE_HOMEPAGE': metadata.get('homepage', ''),
-                'PACKAGE_LICENSE': metadata.get('license', ''),
-                'PACKAGE_ARCH': metadata.get('arch', 'amd64'),
-                'PACKAGE_PLATFORM': metadata.get('platform', 'linux')
-            })
-
-            # Run the build script
-            build_script = temp_resources_dir / "build.sh"
-            if not build_script.exists():
-                logger.error(f"Build script not found: {build_script}")
-                return False
-
-            # Make build script executable
-            build_script.chmod(0o755)
-
-            logger.debug(f"Running build script: {build_script}")
-            result = subprocess.run(
-                [str(build_script)],
-                cwd=app_dir,
-                env=build_env,
-                capture_output=True,
-                text=True
-            )
-
-            if result.returncode != 0:
-                logger.error(f"Native build failed for {package_name}")
-                logger.error(f"stdout: {result.stdout}")
-                logger.error(f"stderr: {result.stderr}")
-                return False
-
-            # Copy artifacts to final destination
-            if app_dist_dir.exists():
-                for item in app_dist_dir.iterdir():
-                    if item.is_file():
-                        shutil.copy2(item, package_dist_dir)
-
-            logger.info(f"Successfully built {package_name}-{package_version}-{package_release} natively")
-            return True
-
-    except Exception as e:
-        logger.error(f"Unexpected error building {package_name} natively: {e}")
-        return False
-
-
-def build_package_buildah(
+def build_package_kaniko(
     package_dir: Path,
     package_name: str,
     package_version: str,
@@ -990,7 +838,7 @@ def build_package_buildah(
     dry_run: bool = False
 ) -> bool:
     """
-    Build a package using Buildah without Docker daemon.
+    Build a package using Kaniko without Docker daemon.
 
     Args:
         package_dir: Directory containing the package resources
@@ -1013,140 +861,103 @@ def build_package_buildah(
         if not dry_run:
             package_dist_dir.mkdir(parents=True, exist_ok=True)
 
-        # Generate container name
-        container_name = f"{package_name}-{package_version}-buildah"
+        # Create a temporary workspace for Kaniko
+        import tempfile
+        with tempfile.TemporaryDirectory() as temp_dir:
+            temp_path = Path(temp_dir)
 
-        # Read metadata.yaml to get all package fields
-        metadata_file = package_dir / "metadata.yaml"
-        metadata = {}
-        if metadata_file.exists():
-            try:
-                with open(metadata_file, 'r') as f:
-                    metadata = yaml.safe_load(f) or {}
-            except Exception as e:
-                logger.warning(f"Could not read metadata.yaml: {e}")
+            # Copy package resources to temp directory
+            import shutil
+            temp_resources_dir = temp_path / "resources"
+            shutil.copytree(package_dir / "resources", temp_resources_dir)
 
-        logger.info(f"Building RPM for {package_name} version {package_version} using Buildah")
+            # Copy Dockerfile to temp directory
+            central_dockerfile = package_dir.parent.parent / "Dockerfile"
+            shutil.copy2(central_dockerfile, temp_path / "Dockerfile")
 
-        if dry_run:
-            logger.info(f"[DRY RUN] Would use Buildah to build from: {base_image}")
-            logger.info("[DRY RUN] Would set environment variables:")
-            logger.info(f"[DRY RUN]   PACKAGE_NAME={package_name}")
-            logger.info(f"[DRY RUN]   PACKAGE_VERSION={package_version}")
-            logger.info(f"[DRY RUN]   PACKAGE_RELEASE={package_release}")
-            logger.info(f"[DRY RUN] Would copy artifacts to: {package_dist_dir}")
-            return True
+            # Read metadata.yaml to get all package fields
+            metadata_file = package_dir / "metadata.yaml"
+            metadata = {}
+            if metadata_file.exists():
+                try:
+                    with open(metadata_file, 'r') as f:
+                        metadata = yaml.safe_load(f) or {}
+                except Exception as e:
+                    logger.warning(f"Could not read metadata.yaml: {e}")
 
-        try:
-            # Step 1: Create a working container from base image
-            from_args = ['buildah', 'from', '--name', container_name, base_image]
-            logger.debug(f"Running: {' '.join(from_args)}")
-            result = subprocess.run(from_args, capture_output=True, text=True)
+            logger.info(f"Building RPM for {package_name} version {package_version} using Kaniko")
 
-            if result.returncode != 0:
-                logger.error(f"Failed to create Buildah container from {base_image}")
-                logger.error(f"stderr: {result.stderr}")
-                return False
+            if dry_run:
+                logger.info(f"[DRY RUN] Would use Kaniko to build from: {temp_path}")
+                logger.info(f"[DRY RUN] Would use base image: {base_image}")
+                logger.info("[DRY RUN] Would pass build arguments:")
+                logger.info(f"[DRY RUN]   PACKAGE_NAME={package_name}")
+                logger.info(f"[DRY RUN]   PACKAGE_VERSION={package_version}")
+                logger.info(f"[DRY RUN]   PACKAGE_RELEASE={package_release}")
+                logger.info(f"[DRY RUN] Would copy artifacts to: {package_dist_dir}")
+                return True
 
-            # Step 2: Set environment variables
-            env_vars = {
-                'PACKAGE_NAME': package_name,
-                'PACKAGE_VERSION': package_version,
-                'PACKAGE_RELEASE': package_release,
-                'PACKAGE_DESCRIPTION': metadata.get('description', ''),
-                'PACKAGE_MAINTAINER': metadata.get('maintainer', ''),
-                'PACKAGE_HOMEPAGE': metadata.get('homepage', ''),
-                'PACKAGE_LICENSE': metadata.get('license', ''),
-                'PACKAGE_ARCH': metadata.get('arch', 'amd64'),
-                'PACKAGE_PLATFORM': metadata.get('platform', 'linux')
-            }
-
-            for key, value in env_vars.items():
-                config_args = ['buildah', 'config', '--env', f'{key}={value}', container_name]
-                logger.debug(f"Running: {' '.join(config_args)}")
-                result = subprocess.run(config_args, capture_output=True, text=True)
-                if result.returncode != 0:
-                    logger.error(f"Failed to set environment variable {key}")
-                    return False
-
-            # Step 3: Copy resources to container
-            copy_args = [
-                'buildah', 'copy', container_name,
-                str(package_dir / "resources"), '/app/resources'
+            # Build using Kaniko
+            kaniko_args = [
+                '/kaniko/executor',
+                '--context', str(temp_path),
+                '--dockerfile', str(temp_path / "Dockerfile"),
+                '--build-arg', f'BASE_IMAGE={base_image}',
+                '--build-arg', f'PACKAGE_NAME={package_name}',
+                '--build-arg', f'PACKAGE_VERSION={package_version}',
+                '--build-arg', f'PACKAGE_RELEASE={package_release}',
+                '--build-arg', f'PACKAGE_DESCRIPTION={metadata.get("description", "")}',
+                '--build-arg', f'PACKAGE_MAINTAINER={metadata.get("maintainer", "")}',
+                '--build-arg', f'PACKAGE_HOMEPAGE={metadata.get("homepage", "")}',
+                '--build-arg', f'PACKAGE_LICENSE={metadata.get("license", "")}',
+                '--build-arg', f'PACKAGE_ARCH={metadata.get("arch", "amd64")}',
+                '--build-arg', f'PACKAGE_PLATFORM={metadata.get("platform", "linux")}',
+                '--no-push',  # Don't push to registry, just build
+                '--tar-path', str(temp_path / "image.tar")
             ]
-            logger.debug(f"Running: {' '.join(copy_args)}")
-            result = subprocess.run(copy_args, capture_output=True, text=True)
+
+            logger.debug(f"Running: {' '.join(kaniko_args)}")
+            result = subprocess.run(
+                kaniko_args,
+                capture_output=True,
+                text=True,
+                cwd=temp_path
+            )
 
             if result.returncode != 0:
-                logger.error(f"Failed to copy resources to container")
-                logger.error(f"stderr: {result.stderr}")
-                return False
-
-            # Step 4: Create dist directory in container
-            run_args = ['buildah', 'run', container_name, 'mkdir', '-p', '/app/dist']
-            logger.debug(f"Running: {' '.join(run_args)}")
-            result = subprocess.run(run_args, capture_output=True, text=True)
-
-            # Step 5: Run the build script
-            run_args = ['buildah', 'run', '--workingdir', '/app', container_name, '/app/resources/build.sh']
-            logger.debug(f"Running: {' '.join(run_args)}")
-            result = subprocess.run(run_args, capture_output=True, text=True)
-
-            if result.returncode != 0:
-                logger.error(f"Buildah build script failed for {package_name}")
+                logger.error(f"Kaniko build failed for {package_name}")
                 logger.error(f"stdout: {result.stdout}")
                 logger.error(f"stderr: {result.stderr}")
                 return False
 
-            # Step 6: Copy artifacts from container to host
-            copy_out_args = [
-                'buildah', 'run', container_name,
-                'find', '/app/dist', '-type', 'f', '-name', '*.rpm'
+            # Extract the artifacts from the built image
+            extract_args = [
+                'tar', '-xf', str(temp_path / "image.tar"),
+                '-C', str(temp_path),
+                '--strip-components=1',
+                'app/dist'
             ]
-            result = subprocess.run(copy_out_args, capture_output=True, text=True)
-            logger.debug(f"Find RPMs result: {result.stdout}")
 
-            if result.returncode == 0 and result.stdout.strip():
-                rpm_files = result.stdout.strip().split('\n')
-                logger.info(f"Found {len(rpm_files)} RPM files to copy")
+            logger.debug(f"Running: {' '.join(extract_args)}")
+            result = subprocess.run(extract_args, capture_output=True, text=True)
 
-                for rpm_file in rpm_files:
-                    rpm_file = rpm_file.strip()
-                    if rpm_file:
-                        # Use buildah mount to copy files out
-                        mount_args = ['buildah', 'mount', container_name]
-                        mount_result = subprocess.run(mount_args, capture_output=True, text=True)
+            if result.returncode != 0:
+                logger.error(f"Failed to extract artifacts for {package_name}")
+                logger.error(f"stderr: {result.stderr}")
+                return False
 
-                        if mount_result.returncode == 0:
-                            container_path = mount_result.stdout.strip()
-                            source_file = Path(container_path) / rpm_file.lstrip('/')
+            # Copy artifacts to final destination
+            extracted_dist = temp_path / "app" / "dist"
+            if extracted_dist.exists():
+                for item in extracted_dist.iterdir():
+                    if item.is_file():
+                        shutil.copy2(item, package_dist_dir)
 
-                            if source_file.exists():
-                                import shutil
-                                dest_file = package_dist_dir / source_file.name
-                                shutil.copy2(source_file, dest_file)
-                                logger.debug(f"Copied {source_file} to {dest_file}")
-                            else:
-                                logger.error(f"Source file not found: {source_file}")
-
-                            # Unmount
-                            subprocess.run(['buildah', 'unmount', container_name], capture_output=True)
-                        else:
-                            logger.error(f"Failed to mount container: {mount_result.stderr}")
-            else:
-                logger.warning(f"No RPM files found or find command failed: {result.stderr}")
-
-            logger.info(f"Successfully built {package_name}-{package_version}-{package_release} using Buildah")
+            logger.info(f"Successfully built {package_name}-{package_version}-{package_release} using Kaniko")
             return True
 
-        finally:
-            # Step 7: Clean up container
-            rm_args = ['buildah', 'rm', container_name]
-            logger.debug(f"Running: {' '.join(rm_args)}")
-            subprocess.run(rm_args, capture_output=True, text=True)
-
     except Exception as e:
-        logger.error(f"Unexpected error building {package_name} with Buildah: {e}")
+        logger.error(f"Unexpected error building {package_name} with Kaniko: {e}")
         return False
 
 
@@ -1290,9 +1101,7 @@ class Builder:
         release: str,
         dry_run: bool = False,
         force: bool = False,
-        distro: str = 'almalinux/el9',
-        native: bool = False,
-        buildah: bool = False
+        distro: str = 'almalinux/el9'
     ) -> bool:
         """
         Build a single package.
@@ -1368,9 +1177,9 @@ class Builder:
             return False
 
         package_info = PackageInfo(package, version, release, package_dir, distro, base_image)
-        return self._build_package(package_info, dry_run, force, native, buildah)
+        return self._build_package(package_info, dry_run, force)
 
-    def build_all(self, dry_run: bool = False, force: bool = False, parallel: int = 4, distro: str = 'el/9', native: bool = False, buildah: bool = False) -> bool:
+    def build_all(self, dry_run: bool = False, force: bool = False, parallel: int = 4, distro: str = 'el/9') -> bool:
         """
         Build all packages.
 
@@ -1392,29 +1201,29 @@ class Builder:
         self.logger.info(f"Found {len(packages)} packages to process")
 
         if parallel == 1:
-            return self._build_sequential(packages, dry_run, force, native, buildah)
+            return self._build_sequential(packages, dry_run, force)
         else:
-            return self._build_parallel(packages, dry_run, force, parallel, native, buildah)
+            return self._build_parallel(packages, dry_run, force, parallel)
 
-    def _build_sequential(self, packages: List[PackageInfo], dry_run: bool, force: bool, native: bool, buildah: bool) -> bool:
+    def _build_sequential(self, packages: List[PackageInfo], dry_run: bool, force: bool) -> bool:
         """Build packages sequentially."""
         success_count = 0
 
         for package_info in packages:
-            if self._build_package(package_info, dry_run, force, native, buildah):
+            if self._build_package(package_info, dry_run, force):
                 success_count += 1
 
         self.logger.info(f"Built {success_count}/{len(packages)} packages successfully")
         return success_count == len(packages)
 
-    def _build_parallel(self, packages: List[PackageInfo], dry_run: bool, force: bool, parallel: int, native: bool, buildah: bool) -> bool:
+    def _build_parallel(self, packages: List[PackageInfo], dry_run: bool, force: bool, parallel: int) -> bool:
         """Build packages in parallel."""
         success_count = 0
 
         with ThreadPoolExecutor(max_workers=parallel) as executor:
             # Submit all build tasks
             future_to_package = {
-                executor.submit(self._build_package, pkg, dry_run, force, native, buildah): pkg
+                executor.submit(self._build_package, pkg, dry_run, force): pkg
                 for pkg in packages
             }
 
@@ -1431,7 +1240,7 @@ class Builder:
         self.logger.info(f"Built {success_count}/{len(packages)} packages successfully")
         return success_count == len(packages)
 
-    def _build_package(self, package_info: PackageInfo, dry_run: bool, force: bool, native: bool = False, buildah: bool = False) -> bool:
+    def _build_package(self, package_info: PackageInfo, dry_run: bool, force: bool) -> bool:
         """
         Build a single package.
 
@@ -1457,33 +1266,17 @@ class Builder:
                     return True
 
             # Check build tool availability (unless dry run)
-            use_native = native
-            use_buildah = buildah
-            use_docker = not use_native and not use_buildah and check_docker_available()
-            if not use_native and not use_buildah and not use_docker:
-                use_buildah = check_buildah_available()
-            if not use_native and not use_buildah and not use_docker:
-                use_native = check_native_build_deps()
+            use_kaniko = check_kaniko_available()
+            use_docker = not use_kaniko and check_docker_available()
 
-            if not dry_run and not use_native and not use_buildah and not use_docker:
-                self.logger.error("No build tools available (tried native, Buildah, Docker)")
+            if not dry_run and not use_kaniko and not use_docker:
+                self.logger.error("Neither Kaniko nor Docker is available")
                 return False
 
             # Build the package using available tool
-            if use_native:
-                self.logger.debug(f"Using native build for {package_info.name}")
-                return build_package_native(
-                    package_dir=package_info.directory,
-                    package_name=package_info.name,
-                    package_version=package_info.version,
-                    package_release=package_info.release,
-                    dist_dir=self.dist_dir,
-                    repository=package_info.distro,
-                    dry_run=dry_run
-                )
-            elif use_buildah:
-                self.logger.debug(f"Using Buildah to build {package_info.name}")
-                return build_package_buildah(
+            if use_kaniko:
+                self.logger.debug(f"Using Kaniko to build {package_info.name}")
+                return build_package_kaniko(
                     package_dir=package_info.directory,
                     package_name=package_info.name,
                     package_version=package_info.version,
@@ -1766,8 +1559,6 @@ def build(
     distro: str = typer.Option("almalinux/el9", help="Target distro (default: almalinux/el9)"),
     dry_run: bool = typer.Option(False, "--dry-run", help="Show what would be built without building"),
     force: bool = typer.Option(False, "--force", help="Build even if package exists in registry"),
-    native: bool = typer.Option(False, "--native", help="Force native build (skip Docker even if available)"),
-    buildah: bool = typer.Option(False, "--buildah", help="Force Buildah build (requires Buildah)"),
     verbose: bool = typer.Option(False, "--verbose", "-v", help="Enable verbose logging")
 ):
     """Build a specific package."""
@@ -1829,9 +1620,7 @@ def build(
             release=str(release),
             dry_run=dry_run,
             force=force,
-            distro=distro,
-            native=native,
-            buildah=buildah
+            distro=distro
         )
 
         if not success:
@@ -1847,8 +1636,6 @@ def build_all(
     force: bool = typer.Option(False, "--force", help="Build even if packages exist in registry"),
     parallel: int = typer.Option(4, help="Number of parallel builds"),
     distro: str = typer.Option("almalinux/el9", help="Target distro (almalinux/el8, almalinux/el9, or 'all' for all distros)"),
-    native: bool = typer.Option(False, "--native", help="Force native build (skip Docker even if available)"),
-    buildah: bool = typer.Option(False, "--buildah", help="Force Buildah build (requires Buildah)"),
     verbose: bool = typer.Option(False, "--verbose", "-v", help="Enable verbose logging")
 ):
     """Build all packages."""
@@ -1862,9 +1649,7 @@ def build_all(
             dry_run=dry_run,
             force=force,
             parallel=parallel,
-            distro=distro,
-            native=native,
-            buildah=buildah
+            distro=distro
         )
 
         if not success:

tools/update-gh

@@ -154,33 +154,6 @@ def load_env_vars(env_file: Path) -> Dict[str, str]:
     return env_vars
 
 
-def get_claude_ai_latest_version() -> Optional[str]:
-    """
-    Get the latest claude-code version from downloads.claude.ai.
-
-    Returns:
-        Latest version string or None if not found
-    """
-    logger = logging.getLogger(__name__)
-
-    try:
-        url = "https://downloads.claude.ai/claude-code-releases/latest"
-        logger.debug(f"Checking claude-code latest version: {url}")
-        response = requests.get(url, timeout=30)
-
-        if response.status_code == 200:
-            version = response.text.strip()
-            logger.debug(f"Latest claude-code version: {version}")
-            return version
-        else:
-            logger.warning(f"Unexpected response from claude.ai: {response.status_code}")
-            return None
-
-    except requests.RequestException as e:
-        logger.error(f"Failed to check claude-code version: {e}")
-        return None
-
-
 def get_github_latest_release(repo: str) -> Optional[Dict]:
     """
     Get the latest release from GitHub API.
@@ -342,30 +315,26 @@ def check_package_updates(package_dir: Path, dry_run: bool = False) -> bool:
         package_name = metadata.get('name', package_dir.name)
         current_version = metadata.get('version')
         github_repo = metadata.get('github')
-        claude_ai = metadata.get('claude_ai', False)
 
-        if not github_repo and not claude_ai:
-            logger.debug(f"Package {package_name} has no GitHub repo or claude_ai configured")
+        if not github_repo:
+            logger.debug(f"Package {package_name} has no GitHub repo configured")
             return True
 
         if not current_version:
             logger.warning(f"Package {package_name} has no version in metadata")
             return False
 
-        if claude_ai:
-            logger.info(f"Checking {package_name} (current: {current_version}) from downloads.claude.ai")
-            latest_version = get_claude_ai_latest_version()
-            if not latest_version:
-                return False
-        else:
-            logger.info(f"Checking {package_name} (current: {current_version}) from {github_repo}")
-            latest_release = get_github_latest_release(github_repo)
-            if not latest_release:
-                return False
-            latest_version = normalize_version(latest_release.get('tag_name', ''))
-            if not latest_version:
-                logger.warning(f"Could not determine latest version for {package_name}")
-                return False
+        logger.info(f"Checking {package_name} (current: {current_version}) from {github_repo}")
+
+        # Get latest release from GitHub
+        latest_release = get_github_latest_release(github_repo)
+        if not latest_release:
+            return False
+
+        latest_version = normalize_version(latest_release.get('tag_name', ''))
+        if not latest_version:
+            logger.warning(f"Could not determine latest version for {package_name}")
+            return False
 
         # Compare versions
         if compare_versions(current_version, latest_version):
@@ -404,7 +373,7 @@ def find_packages_with_github(rpms_dir: Path) -> List[Path]:
             with open(metadata_file, 'r') as f:
                 metadata = yaml.safe_load(f)
 
-            if metadata.get('github') or metadata.get('claude_ai'):
+            if metadata.get('github'):
                 github_packages.append(package_dir)
         except Exception:
             continue
@@ -490,4 +459,4 @@ Examples:
 
 
 if __name__ == '__main__':
-    main()
+    main()