Merge branch 'master' into benvin/tea

Merge pull request 'benvin/escape_secret' (#113 ) from benvin/escape_secret into master
Reviewed-on: #113
2026-04-26 21:21:16 +10:00 · 2026-04-26 21:11:29 +10:00 · 2026-04-26 21:07:49 +10:00 · 2026-04-26 21:07:49 +10:00 · 2026-04-26 19:50:59 +10:00 · 2026-04-26 16:58:37 +10:00
76 changed files with 625 additions and 219 deletions
@@ -1,59 +0,0 @@
-name: Build
-
-on:
-  pull_request:
-  workflow_call:
-  workflow_dispatch:
-
-jobs:
-  build-8:
-    runs-on: almalinux-8
-    container:
-      image: git.unkin.net/unkin/almalinux8-actionsdind:latest
-      options: "--privileged --volume /etc/pki/tls/vault:/etc/pki/tls/vault:ro"
-
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v3
-
-      - name: Build Packages
-        env:
-          VAULT_ROLE_ID: ${{ secrets.RPMBUILDER_VAULT_ROLEID }}
-        run: |
-          ./tools/build build-all --distro almalinux/el8
-
-      - name: Show RPMs
-        run: |
-          find /workspace -type f -name "*.rpm"
-
-      - name: Upload Artifacts
-        uses: actions/upload-artifact@v3
-        with:
-          name: rpms-8
-          path: /workspace/unkin/rpmbuilder/dist/*/*/*.rpm
-
-  build-9:
-    runs-on: almalinux-8
-    container:
-      image: git.unkin.net/unkin/almalinux9-actionsdind:latest
-      options: "--privileged --volume /etc/pki/tls/vault:/etc/pki/tls/vault:ro"
-
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v3
-
-      - name: Build Packages
-        env:
-          VAULT_ROLE_ID: ${{ secrets.RPMBUILDER_VAULT_ROLEID }}
-        run: |
-          ./tools/build build-all --distro almalinux/el9
-
-      - name: Show RPMs
-        run: |
-          find /workspace -type f -name "*.rpm"
-
-      - name: Upload Artifacts
-        uses: actions/upload-artifact@v3
-        with:
-          name: rpms-9
-          path: /workspace/unkin/rpmbuilder/dist/*/*/*.rpm
@@ -1,66 +0,0 @@
-name: Deploy
-
-on:
-  push:
-    branches:
-      - master
-  workflow_dispatch:
-
-jobs:
-  deploy-8:
-    runs-on: almalinux-8
-    container:
-      image: git.unkin.net/unkin/almalinux8-actionsdind:latest
-      options: --privileged
-
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v3
-
-      - name: Download Artifacts
-        run: |
-          mkdir -p /workspace/unkin/rpmbuilder/dist/almalinux/el8
-          export PREVIOUS_RUN_ID=$((GITHUB_RUN_NUMBER - 1))
-          curl -L -o /workspace/rpms.zip "https://git.unkin.net/${GITHUB_REPOSITORY}/actions/runs/${PREVIOUS_RUN_ID}/artifacts/rpms-8"
-          unzip /workspace/rpms.zip -d /workspace/unkin/rpmbuilder/dist/almalinux/el8
-
-      - name: Show RPMs
-        run: |
-          find /workspace -type f -name "*.rpm"
-
-      - name: Upload RPMs to Gitea
-        env:
-          DRONECI_PASSWORD: ${{ secrets.DRONECI_PASSWORD }}
-        run: |
-          for rpm in $(find /workspace/unkin/rpmbuilder/dist/almalinux/el8 -type f -name "*.rpm"); do
-            curl --user droneci:${{ secrets.DRONECI_PASSWORD }} --upload-file $rpm https://git.unkin.net/api/packages/unkin/rpm/almalinux/el8/upload
-          done
-
-  deploy-9:
-    runs-on: almalinux-8
-    container:
-      image: git.unkin.net/unkin/almalinux9-actionsdind:latest
-      options: --privileged
-
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v3
-
-      - name: Download Artifacts
-        run: |
-          mkdir -p /workspace/unkin/rpmbuilder/dist/almalinux/el9
-          export PREVIOUS_RUN_ID=$((GITHUB_RUN_NUMBER - 1))
-          curl -L -o /workspace/rpms.zip "https://git.unkin.net/${GITHUB_REPOSITORY}/actions/runs/${PREVIOUS_RUN_ID}/artifacts/rpms-9"
-          unzip /workspace/rpms.zip -d /workspace/unkin/rpmbuilder/dist/almalinux/el9
-
-      - name: Show RPMs
-        run: |
-          find /workspace -type f -name "*.rpm"
-
-      - name: Upload RPMs to Gitea
-        env:
-          DRONECI_PASSWORD: ${{ secrets.DRONECI_PASSWORD }}
-        run: |
-          for rpm in $(find /workspace/unkin/rpmbuilder/dist/almalinux/el9 -type f -name "*.rpm"); do
-            curl --user droneci:${{ secrets.DRONECI_PASSWORD }} --upload-file $rpm https://git.unkin.net/api/packages/unkin/rpm/almalinux/el9/upload
-          done
@@ -3,12 +3,24 @@ repos:
  - repo: https://github.com/pre-commit/pre-commit-hooks
    rev: v4.5.0
    hooks:
-      - id: trailing-whitespace
-      - id: end-of-file-fixer
+      - id: check-executables-have-shebangs
+      - id: check-json
+      - id: check-added-large-files
+        args: ['--maxkb=500']
+      - id: check-merge-conflict
+      - id: check-shebang-scripts-are-executable
+      - id: check-symlinks
+      - id: check-toml
      - id: check-yaml
        args: [--allow-multiple-documents]
-      - id: check-merge-conflict
+      - id: detect-aws-credentials
+        args: [--allow-missing-credentials]
      - id: detect-private-key
+      - id: end-of-file-fixer
+      - id: forbid-new-submodules
+      - id: pretty-format-json
+      - id: trailing-whitespace
+
  - repo: https://github.com/adrienverge/yamllint.git
    rev: v1.37.1
    hooks:
@@ -18,6 +30,7 @@ repos:
            "-d {extends: relaxed, rules: {line-length: disable}}",
            "-s",
          ]
+
  - repo: https://github.com/astral-sh/ruff-pre-commit
    rev: v0.14.7
    hooks:
@@ -3,13 +3,18 @@ when:

 steps:
  - name: build rpms
-    image: git.unkin.net/unkin/almalinux8-rpmbuilder:latest
+    image: git.unkin.net/unkin/almalinux9-rpmbuilder:latest
    commands:
-      - ./tools/build build-all --distro almalinux/el8
+      - mkdir -p /woodpecker/rpms
+      - ln -s /woodpecker/rpms /workspace
+      - dnf install buildah -y
+      - ./tools/build build-all --distro almalinux/el8 --buildah
+    privileged: true
    backend_options:
      kubernetes:
        serviceAccountName: default
+
  - name: show rpms
    image: git.unkin.net/unkin/almalinux8-base:latest
    commands:
-      - find /workspace -type f -name "*.rpm"
+      - find /woodpecker/src/git.unkin.net/unkin/rpmbuilder/ -type f -name "*.rpm"
@@ -5,11 +5,16 @@ steps:
  - name: build rpms
    image: git.unkin.net/unkin/almalinux9-rpmbuilder:latest
    commands:
-      - ./tools/build build-all --distro almalinux/el9 --native
+      - mkdir -p /woodpecker/rpms
+      - ln -s /woodpecker/rpms /workspace
+      - dnf install buildah -y
+      - ./tools/build build-all --distro almalinux/el9 --buildah
+    privileged: true
    backend_options:
      kubernetes:
        serviceAccountName: default
+
  - name: show rpms
-    image: git.unkin.net/unkin/almalinux8-base:latest
+    image: git.unkin.net/unkin/almalinux9-base:latest
    commands:
-      - find /workspace -type f -name "*.rpm"
+      - find /woodpecker/src/git.unkin.net/unkin/rpmbuilder/ -type f -name "*.rpm"
@@ -0,0 +1,37 @@
+when:
+  - event: push
+    branch: master
+
+steps:
+  - name: build-rpms
+    image: git.unkin.net/unkin/almalinux9-rpmbuilder:latest
+    commands:
+      - mkdir -p /woodpecker/rpms
+      - ln -s /woodpecker/rpms /workspace
+      - dnf install buildah -y
+      - ./tools/build build-all --distro almalinux/el8 --buildah
+    privileged: true
+    backend_options:
+      kubernetes:
+        serviceAccountName: default
+
+  - name: show-rpms
+    image: git.unkin.net/unkin/almalinux9-base:latest
+    commands:
+      - find /woodpecker/src/git.unkin.net/unkin/rpmbuilder/ -type f -name "*.rpm"
+    depends_on: [build-rpms]
+
+  - name: deploy-rpms
+    image: git.unkin.net/unkin/almalinux9-rpmbuilder:latest
+    commands:
+      - |
+        for rpm in $(find /woodpecker/src/git.unkin.net/unkin/rpmbuilder/ -type f -name "*.rpm"); do
+          curl --user droneci:$${DRONECI_PASSWORD} --upload-file $rpm https://git.unkin.net/api/packages/unkin/rpm/almalinux/el8/upload
+        done
+    environment:
+      DRONECI_PASSWORD:
+        from_secret: DRONECI_PASSWORD
+    backend_options:
+      kubernetes:
+        serviceAccountName: default
+    depends_on: [build-rpms, show-rpms]
@@ -0,0 +1,37 @@
+when:
+  - event: push
+    branch: master
+
+steps:
+  - name: build-rpms
+    image: git.unkin.net/unkin/almalinux9-rpmbuilder:latest
+    commands:
+      - mkdir -p /woodpecker/rpms
+      - ln -s /woodpecker/rpms /workspace
+      - dnf install buildah -y
+      - ./tools/build build-all --distro almalinux/el9 --buildah
+    privileged: true
+    backend_options:
+      kubernetes:
+        serviceAccountName: default
+
+  - name: show-rpms
+    image: git.unkin.net/unkin/almalinux9-base:latest
+    commands:
+      - find /woodpecker/src/git.unkin.net/unkin/rpmbuilder/ -type f -name "*.rpm"
+    depends_on: [build-rpms]
+
+  - name: deploy-rpms
+    image: git.unkin.net/unkin/almalinux9-rpmbuilder:latest
+    commands:
+      - |
+        for rpm in $(find /woodpecker/src/git.unkin.net/unkin/rpmbuilder/ -type f -name "*.rpm"); do
+          curl --user droneci:$${DRONECI_PASSWORD} --upload-file $rpm https://git.unkin.net/api/packages/unkin/rpm/almalinux/el9/upload
+        done
+    environment:
+      DRONECI_PASSWORD:
+        from_secret: DRONECI_PASSWORD
+    backend_options:
+      kubernetes:
+        serviceAccountName: default
+    depends_on: [build-rpms, show-rpms]
@@ -31,4 +31,4 @@ ENV PACKAGE_PLATFORM=${PACKAGE_PLATFORM}
 COPY resources /app/resources

 # Default command to build RPMs
-CMD /app/resources/build.sh
+CMD /app/resources/build.sh
@@ -31,6 +31,11 @@ build-all-native:
 	@echo "Building all packages natively (no Docker) for distro $(DISTRO)..."
 	$(BUILD_TOOL) build-all --distro $(DISTRO) --native

+# Build all packages using Buildah
+build-all-buildah:
+	@echo "Building all packages using Buildah for distro $(DISTRO)..."
+	$(BUILD_TOOL) build-all --distro $(DISTRO) --buildah
+
 # Build specific package using Python tool
 .PHONY: $(PACKAGES)
 $(PACKAGES):
@@ -8,4 +8,4 @@ wget -O /app/boilerplate https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote
 envsubst < /app/resources/nfpm.yaml > /app/nfpm.yaml

 # Build the RPM
-nfpm pkg --config /app/nfpm.yaml --target /app/dist --packager rpm
+nfpm pkg --config /app/nfpm.yaml --target /app/dist --packager rpm
@@ -0,0 +1,18 @@
+---
+arch: amd64
+builds:
+  - image: git.unkin.net/unkin/almalinux8-rpmbuilder:latest
+    release: '1'
+    repository: [almalinux/el8]
+    version: 2.1.120
+  - image: git.unkin.net/unkin/almalinux9-rpmbuilder:latest
+    release: '1'
+    repository: [almalinux/el9]
+    version: 2.1.120
+claude_ai: true
+description: Claude Code - Anthropic's agentic AI coding tool
+homepage: https://claude.ai/code
+license: Proprietary
+maintainer: Anthropic
+name: claude-code
+platform: linux
@@ -0,0 +1,13 @@
+#!/usr/bin/bash
+
+set -e
+
+# Download claude-code binary
+wget -O /app/claude https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/claude-ai/claude-code-releases/${PACKAGE_VERSION}/linux-x64/claude
+chmod +x /app/claude
+
+# Process the nfpm.yaml template with environment variables
+envsubst < /app/resources/nfpm.yaml > /app/nfpm.yaml
+
+# Build the RPM
+nfpm pkg --config /app/nfpm.yaml --target /app/dist --packager rpm
@@ -0,0 +1,33 @@
+# nfpm.yaml
+
+name: ${PACKAGE_NAME}
+version: ${PACKAGE_VERSION}
+release: ${PACKAGE_RELEASE}
+arch: ${PACKAGE_ARCH}
+platform: ${PACKAGE_PLATFORM}
+section: default
+priority: extra
+description: "${PACKAGE_DESCRIPTION}"
+
+maintainer: ${PACKAGE_MAINTAINER}
+homepage: ${PACKAGE_HOMEPAGE}
+license: ${PACKAGE_LICENSE}
+
+disable_globbing: false
+
+replaces:
+  - claude-code
+  - claude
+
+provides:
+  - claude-code
+  - claude
+
+# Files to include in the package
+contents:
+  - src: /app/claude
+    dst: /usr/bin/claude
+    file_info:
+      mode: 0755
+      owner: root
+      group: root
@@ -9,4 +9,4 @@ tar xf cni-plugins-linux-amd64.tgz
 envsubst < /app/resources/nfpm.yaml > /app/nfpm.yaml

 # Build the RPM
-nfpm pkg --config /app/nfpm.yaml --target /app/dist --packager rpm
+nfpm pkg --config /app/nfpm.yaml --target /app/dist --packager rpm
@@ -12,4 +12,4 @@ unzip consul-cni.zip
 # Process the nfpm.yaml template with environment variables
 envsubst < /app/resources/nfpm.yaml > /app/nfpm.yaml

-nfpm pkg --config /app/nfpm.yaml --target /app/dist --packager rpm
+nfpm pkg --config /app/nfpm.yaml --target /app/dist --packager rpm
@@ -13,4 +13,4 @@ unzip consul.zip
 envsubst < /app/resources/nfpm.yaml > /app/nfpm.yaml

 # Build the RPM
-nfpm pkg --config /app/nfpm.yaml --target /app/dist --packager rpm
+nfpm pkg --config /app/nfpm.yaml --target /app/dist --packager rpm
@@ -10,4 +10,4 @@ mv /app/etcd-v${PACKAGE_VERSION}-linux-amd64/* /app/
 envsubst < /app/resources/nfpm.yaml > /app/nfpm.yaml

 # Build the RPM
-nfpm pkg --config /app/nfpm.yaml --target /app/dist --packager rpm
+nfpm pkg --config /app/nfpm.yaml --target /app/dist --packager rpm
@@ -11,4 +11,4 @@ popd
 envsubst < /app/resources/nfpm.yaml > /app/nfpm.yaml

 # Build the RPM
-nfpm pkg --config /app/nfpm.yaml --target /app/dist --packager rpm
+nfpm pkg --config /app/nfpm.yaml --target /app/dist --packager rpm
@@ -15,4 +15,4 @@ chmod +x /app/helmfile
 # Process the nfpm.yaml template with environment variables
 envsubst < /app/resources/nfpm.yaml > /app/nfpm.yaml

-nfpm pkg --config /app/nfpm.yaml --target /app/dist --packager rpm
+nfpm pkg --config /app/nfpm.yaml --target /app/dist --packager rpm
@@ -14,4 +14,4 @@ rpmbuild -ba /root/rpmbuild/SPECS/jellyfin-ffmpeg-bin.spec

 # Copy the built RPMs to output directory
 cp /root/rpmbuild/RPMS/x86_64/jellyfin-ffmpeg-bin-*.rpm /app/dist/
-cp /root/rpmbuild/SRPMS/jellyfin-ffmpeg-bin-*.rpm /app/dist
+cp /root/rpmbuild/SRPMS/jellyfin-ffmpeg-bin-*.rpm /app/dist
@@ -18,4 +18,4 @@ rpmbuild -ba /app/resources/jellyfin-server_${PACKAGE_VERSION}.spec

 # Copy the built RPMs to output directory
 cp /root/rpmbuild/RPMS/x86_64/jellyfin-server-${PACKAGE_VERSION}-${PACKAGE_RELEASE}.x86_64.rpm /app/dist/
-cp /root/rpmbuild/SRPMS/jellyfin-server-${PACKAGE_VERSION}-${PACKAGE_RELEASE}.src.rpm /app/dist/
+cp /root/rpmbuild/SRPMS/jellyfin-server-${PACKAGE_VERSION}-${PACKAGE_RELEASE}.src.rpm /app/dist/
@@ -15,4 +15,4 @@ rpmbuild -ba /app/resources/jellyfin-web_${PACKAGE_VERSION}.spec

 # Copy the built RPMs to output directory
 cp /root/rpmbuild/RPMS/noarch/jellyfin-web-${PACKAGE_VERSION}-${PACKAGE_RELEASE}.noarch.rpm /app/dist/
-cp /root/rpmbuild/SRPMS/jellyfin-web-${PACKAGE_VERSION}-${PACKAGE_RELEASE}.src.rpm /app/dist/
+cp /root/rpmbuild/SRPMS/jellyfin-web-${PACKAGE_VERSION}-${PACKAGE_RELEASE}.src.rpm /app/dist/
@@ -11,4 +11,4 @@ chmod +x /app/jsonnet-language-server
 # Process the nfpm.yaml template with environment variables
 envsubst < /app/resources/nfpm.yaml > /app/nfpm.yaml

-nfpm pkg --config /app/nfpm.yaml --target /app/dist --packager rpm
+nfpm pkg --config /app/nfpm.yaml --target /app/dist --packager rpm
@@ -20,4 +20,4 @@ GOBIN=/app go install github.com/google/go-jsonnet/cmd/jsonnet-lint@v${PACKAGE_V
 envsubst < /app/resources/nfpm.yaml > /app/nfpm.yaml

 # Build RPM package
-nfpm pkg --config /app/nfpm.yaml --target /app/dist --packager rpm
+nfpm pkg --config /app/nfpm.yaml --target /app/dist --packager rpm
@@ -21,4 +21,4 @@ GOBIN=/app go install github.com/google/go-jsonnet/cmd/jsonnetfmt@v${PACKAGE_VER
 envsubst < /app/resources/nfpm.yaml > /app/nfpm.yaml

 # Build RPM package
-nfpm pkg --config /app/nfpm.yaml --target /app/dist --packager rpm
+nfpm pkg --config /app/nfpm.yaml --target /app/dist --packager rpm
@@ -11,4 +11,4 @@ tar -xzf /app/kubeconform-linux-amd64.tar.gz -C /app/
 envsubst < /app/resources/nfpm.yaml > /app/nfpm.yaml

 # Build the RPM
-nfpm pkg --config /app/nfpm.yaml --target /app/dist --packager rpm
+nfpm pkg --config /app/nfpm.yaml --target /app/dist --packager rpm
@@ -11,4 +11,4 @@ chmod 755 /app/libfdb_c.so
 # Process the nfpm.yaml template with environment variables
 envsubst < /app/resources/nfpm.yaml > /app/nfpm.yaml

-nfpm pkg --config /app/nfpm.yaml --target /app/dist --packager rpm
+nfpm pkg --config /app/nfpm.yaml --target /app/dist --packager rpm
@@ -1,4 +1,4 @@
 #!/usr/bin/env bash

 # Update the dynamic linker cache to include the new library
-ldconfig
+ldconfig
@@ -11,4 +11,4 @@ GOBIN=/app go install github.com/goreleaser/nfpm/v2/cmd/nfpm@v${PACKAGE_VERSION}
 envsubst < /app/resources/nfpm.yaml > /app/nfpm.yaml

 # Build the RPM
-nfpm pkg --config /app/nfpm.yaml --target /app/dist --packager rpm
+nfpm pkg --config /app/nfpm.yaml --target /app/dist --packager rpm
@@ -12,4 +12,4 @@ unzip nomad-autoscaler.zip
 # Process the nfpm.yaml template with environment variables
 envsubst < /app/resources/nfpm.yaml > /app/nfpm.yaml

-nfpm pkg --config /app/nfpm.yaml --target /app/dist --packager rpm
+nfpm pkg --config /app/nfpm.yaml --target /app/dist --packager rpm
@@ -12,4 +12,4 @@ unzip nomad.zip
 # Process the nfpm.yaml template with environment variables
 envsubst < /app/resources/nfpm.yaml > /app/nfpm.yaml

-nfpm pkg --config /app/nfpm.yaml --target /app/dist --packager rpm
+nfpm pkg --config /app/nfpm.yaml --target /app/dist --packager rpm
@@ -4,4 +4,4 @@ set -e

 # Download the pre-built RPM from GitHub releases
 curl -L -o /app/dist/nzbget-${PACKAGE_VERSION}-${PACKAGE_RELEASE}.x86_64.rpm \
-  https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/github/nzbgetcom/nzbget/releases/download/v$PACKAGE_VERSION/nzbget-${PACKAGE_VERSION}-${PACKAGE_RELEASE}.x86_64.rpm
+  https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/github/nzbgetcom/nzbget/releases/download/v$PACKAGE_VERSION/nzbget-${PACKAGE_VERSION}-${PACKAGE_RELEASE}.x86_64.rpm
@@ -17,4 +17,4 @@ chmod +x /app/openbao-plugin-secrets-consul
 # Process the nfpm.yaml template with environment variables
 envsubst < /app/resources/nfpm.yaml > /app/nfpm.yaml

-nfpm pkg --config /app/nfpm.yaml --target /app/dist --packager rpm
+nfpm pkg --config /app/nfpm.yaml --target /app/dist --packager rpm
@@ -1,2 +1,2 @@
 #!/usr/bin/env bash
-mkdir -p /opt/openbao-plugins
+mkdir -p /opt/openbao-plugins
@@ -17,4 +17,4 @@ chmod +x /app/openbao-plugin-secrets-nomad
 # Process the nfpm.yaml template with environment variables
 envsubst < /app/resources/nfpm.yaml > /app/nfpm.yaml

-nfpm pkg --config /app/nfpm.yaml --target /app/dist --packager rpm
+nfpm pkg --config /app/nfpm.yaml --target /app/dist --packager rpm
@@ -1,2 +1,2 @@
 #!/usr/bin/env bash
-mkdir -p /opt/openbao-plugins
+mkdir -p /opt/openbao-plugins
@@ -7,4 +7,4 @@ set -e
 envsubst < /app/resources/nfpm.yaml > /app/nfpm.yaml

 # Build the RPM
-nfpm pkg --config /app/nfpm.yaml --target /app/dist --packager rpm
+nfpm pkg --config /app/nfpm.yaml --target /app/dist --packager rpm
@@ -13,4 +13,4 @@ unzip packer.zip
 envsubst < /app/resources/nfpm.yaml > /app/nfpm.yaml

 # Build the RPM
-nfpm pkg --config /app/nfpm.yaml --target /app/dist --packager rpm
+nfpm pkg --config /app/nfpm.yaml --target /app/dist --packager rpm
@@ -11,4 +11,4 @@ mv /app/ruff-x86_64-unknown-linux-gnu/* /app/
 envsubst < /app/resources/nfpm.yaml > /app/nfpm.yaml

 # Build the RPM
-nfpm pkg --config /app/nfpm.yaml --target /app/dist --packager rpm
+nfpm pkg --config /app/nfpm.yaml --target /app/dist --packager rpm
@@ -14,4 +14,4 @@ chmod +x /app/stalwart-cli
 # Process the nfpm.yaml template with environment variables
 envsubst < /app/resources/nfpm.yaml > /app/nfpm.yaml

-nfpm pkg --config /app/nfpm.yaml --target /app/dist --packager rpm
+nfpm pkg --config /app/nfpm.yaml --target /app/dist --packager rpm
@@ -14,4 +14,4 @@ chmod +x /app/stalwart-foundationdb
 # Process the nfpm.yaml template with environment variables
 envsubst < /app/resources/nfpm.yaml > /app/nfpm.yaml

-nfpm pkg --config /app/nfpm.yaml --target /app/dist --packager rpm
+nfpm pkg --config /app/nfpm.yaml --target /app/dist --packager rpm
@@ -4,4 +4,4 @@
 systemctl daemon-reload

 # Note: We don't remove user data, logs, or configuration files
-# to preserve user data in case of reinstallation
+# to preserve user data in case of reinstallation
@@ -17,4 +17,4 @@ mkdir -p /var/log/stalwart
 # Set ownership
 chown -R stalwart:stalwart /opt/stalwart
 chown -R stalwart:stalwart /var/lib/stalwart
-chown -R stalwart:stalwart /var/log/stalwart
+chown -R stalwart:stalwart /var/log/stalwart
@@ -4,4 +4,4 @@
 if systemctl is-enabled stalwart-foundationdb.service >/dev/null 2>&1; then
    systemctl stop stalwart-foundationdb.service
    systemctl disable stalwart-foundationdb.service
-fi
+fi
@@ -23,4 +23,4 @@ ProtectSystem=strict
 ReadWritePaths=/var/lib/stalwart /var/log/stalwart /opt/stalwart/data

 [Install]
-WantedBy=multi-user.target
+WantedBy=multi-user.target
@@ -14,4 +14,4 @@ chmod +x /app/stalwart
 # Process the nfpm.yaml template with environment variables
 envsubst < /app/resources/nfpm.yaml > /app/nfpm.yaml

-nfpm pkg --config /app/nfpm.yaml --target /app/dist --packager rpm
+nfpm pkg --config /app/nfpm.yaml --target /app/dist --packager rpm
@@ -4,4 +4,4 @@
 systemctl daemon-reload

 # Note: We don't remove user data, logs, or configuration files
-# to preserve user data in case of reinstallation
+# to preserve user data in case of reinstallation
@@ -17,4 +17,4 @@ mkdir -p /var/log/stalwart
 # Set ownership
 chown -R stalwart:stalwart /opt/stalwart
 chown -R stalwart:stalwart /var/lib/stalwart
-chown -R stalwart:stalwart /var/log/stalwart
+chown -R stalwart:stalwart /var/log/stalwart
@@ -4,4 +4,4 @@
 if systemctl is-enabled stalwart.service >/dev/null 2>&1; then
    systemctl stop stalwart.service
    systemctl disable stalwart.service
-fi
+fi
@@ -22,4 +22,4 @@ ProtectSystem=strict
 ReadWritePaths=/var/lib/stalwart /var/log/stalwart /opt/stalwart/data

 [Install]
-WantedBy=multi-user.target
+WantedBy=multi-user.target
@@ -0,0 +1,20 @@
+---
+name: stern
+github: stern/stern
+description: Multi pod and container log tailing for Kubernetes.
+arch: amd64
+platform: linux
+maintainer: stern
+homepage: https://github.com/stern/stern
+license: Apache-2.0
+builds:
+- repository:
+  - almalinux/el8
+  image: git.unkin.net/unkin/almalinux8-rpmbuilder:latest
+  release: 1
+  version: 1.33.1
+- repository:
+  - almalinux/el9
+  image: git.unkin.net/unkin/almalinux9-rpmbuilder:latest
+  release: 1
+  version: 1.33.1
@@ -0,0 +1,10 @@
+#!/usr/bin/bash
+
+set -e
+
+wget -O /app/stern_${PACKAGE_VERSION}_linux_amd64.tar.gz https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/github/stern/stern/releases/download/v${PACKAGE_VERSION}/stern_${PACKAGE_VERSION}_linux_amd64.tar.gz
+tar xf /app/stern_${PACKAGE_VERSION}_linux_amd64.tar.gz
+
+envsubst < /app/resources/nfpm.yaml > /app/nfpm.yaml
+
+nfpm pkg --config /app/nfpm.yaml --target /app/dist --packager rpm
@@ -0,0 +1,30 @@
+# nfpm.yaml
+
+name: ${PACKAGE_NAME}
+version: ${PACKAGE_VERSION}
+release: ${PACKAGE_RELEASE}
+arch: ${PACKAGE_ARCH}
+platform: ${PACKAGE_PLATFORM}
+section: default
+priority: extra
+description: "${PACKAGE_DESCRIPTION}"
+
+maintainer: ${PACKAGE_MAINTAINER}
+homepage: ${PACKAGE_HOMEPAGE}
+license: ${PACKAGE_LICENSE}
+
+disable_globbing: false
+
+replaces:
+  - stern
+
+provides:
+  - stern
+
+contents:
+  - src: /app/stern
+    dst: /usr/bin/stern
+    file_info:
+      mode: 0755
+      owner: root
+      group: root
@@ -0,0 +1,20 @@
+---
+name: tea
+github: unknown/tea
+description: The official CLI for Gitea.
+arch: amd64
+platform: linux
+maintainer: Gitea
+homepage: https://gitea.com/gitea/tea
+license: MIT
+builds:
+- repository:
+  - almalinux/el8
+  image: git.unkin.net/unkin/almalinux8-rpmbuilder:latest
+  release: 1
+  version: 0.14.0
+- repository:
+  - almalinux/el9
+  image: git.unkin.net/unkin/almalinux9-rpmbuilder:latest
+  release: 1
+  version: 0.14.0
@@ -0,0 +1,10 @@
+#!/usr/bin/bash
+
+set -e
+
+curl -L --output /app/tea-linux-amd64 https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/gitea-dl/tea/${PACKAGE_VERSION}/tea-${PACKAGE_VERSION}-linux-amd64
+chmod +x /app/tea-linux-amd64
+
+envsubst < /app/resources/nfpm.yaml > /app/nfpm.yaml
+
+nfpm pkg --config /app/nfpm.yaml --target /app/dist --packager rpm
@@ -0,0 +1,30 @@
+# nfpm.yaml
+
+name: ${PACKAGE_NAME}
+version: ${PACKAGE_VERSION}
+release: ${PACKAGE_RELEASE}
+arch: ${PACKAGE_ARCH}
+platform: ${PACKAGE_PLATFORM}
+section: default
+priority: extra
+description: "${PACKAGE_DESCRIPTION}"
+
+maintainer: ${PACKAGE_MAINTAINER}
+homepage: ${PACKAGE_HOMEPAGE}
+license: ${PACKAGE_LICENSE}
+
+disable_globbing: false
+
+replaces:
+  - tea
+
+provides:
+  - tea
+
+contents:
+  - src: /app/tea-linux-amd64
+    dst: /usr/bin/tea
+    file_info:
+      mode: 0755
+      owner: root
+      group: root
@@ -13,4 +13,4 @@ unzip terraform.zip
 envsubst < /app/resources/nfpm.yaml > /app/nfpm.yaml

 # Build the RPM
-nfpm pkg --config /app/nfpm.yaml --target /app/dist --packager rpm
+nfpm pkg --config /app/nfpm.yaml --target /app/dist --packager rpm
@@ -9,4 +9,4 @@ wget -O /app/terragrunt https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/
 envsubst < /app/resources/nfpm.yaml > /app/nfpm.yaml

 # Build the RPM
-nfpm pkg --config /app/nfpm.yaml --target /app/dist --packager rpm
+nfpm pkg --config /app/nfpm.yaml --target /app/dist --packager rpm
@@ -11,4 +11,4 @@ unzip -j /app/tflint_linux_amd64.zip -d /app/
 envsubst < /app/resources/nfpm.yaml > /app/nfpm.yaml

 # Build the RPM
-nfpm pkg --config /app/nfpm.yaml --target /app/dist --packager rpm
+nfpm pkg --config /app/nfpm.yaml --target /app/dist --packager rpm
@@ -8,4 +8,4 @@ curl -L -o /app/UNKIN_ROOTCA_2024.crt https://vault.query.consul:8200/v1/pki_roo
 # Process the nfpm.yaml template with environment variables
 envsubst < /app/resources/nfpm.yaml > /app/nfpm.yaml

-nfpm pkg --config /app/nfpm.yaml --target /app/dist --packager rpm
+nfpm pkg --config /app/nfpm.yaml --target /app/dist --packager rpm
@@ -4,11 +4,11 @@ builds:
  - image: git.unkin.net/unkin/almalinux8-rpmbuilder:latest
    release: '1'
    repository: [almalinux/el8]
-    version: '7.12'
+    version: '7.20'
  - image: git.unkin.net/unkin/almalinux9-rpmbuilder:latest
    release: '1'
    repository: [almalinux/el9]
-    version: '7.12'
+    version: '7.20'
 description: WinRAR is a powerful archive manager. It can backup your data and reduce the size of email attachments, open and unpack RAR, ZIP and other files downloaded from Internet, create new archives in RAR and ZIP file format.
 github: unknown/unrar
 homepage: https://www.rarlab.com/
@@ -4,8 +4,8 @@ set -e

 # Download and extract unrar (with version formatting)
 export DOWNLOAD_VERSION=$(echo $PACKAGE_VERSION | sed s/\\.//)
-curl -L -o /app/rarlinux.tar.gz https://www.rarlab.com/rar/rarlinux-x64-${DOWNLOAD_VERSION}.tar.gz
-tar xf /app/rarlinux.tar.gz
+curl -L -o /app/rarlinux.tar.gz https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/rarlab/rar/rarlinux-x64-${DOWNLOAD_VERSION}.tar.gz
+tar xf /app/rarlinux.tar.gz -C /app
 mv /app/rar/unrar /app/

 # Process the nfpm.yaml template with environment variables
@@ -11,4 +11,4 @@ mv /app/uv-x86_64-unknown-linux-gnu/* /app/
 envsubst < /app/resources/nfpm.yaml > /app/nfpm.yaml

 # Build the RPM
-nfpm pkg --config /app/nfpm.yaml --target /app/dist --packager rpm
+nfpm pkg --config /app/nfpm.yaml --target /app/dist --packager rpm
@@ -15,4 +15,4 @@ chmod +x /app/vals
 # Process the nfpm.yaml template with environment variables
 envsubst < /app/resources/nfpm.yaml > /app/nfpm.yaml

-nfpm pkg --config /app/nfpm.yaml --target /app/dist --packager rpm
+nfpm pkg --config /app/nfpm.yaml --target /app/dist --packager rpm
@@ -13,4 +13,4 @@ unzip vault.zip
 envsubst < /app/resources/nfpm.yaml > /app/nfpm.yaml

 # Build the RPM
-nfpm pkg --config /app/nfpm.yaml --target /app/dist --packager rpm
+nfpm pkg --config /app/nfpm.yaml --target /app/dist --packager rpm
@@ -10,4 +10,4 @@ tar xf victoria-logs-linux-amd64-v${PACKAGE_VERSION}.tar.gz
 # Process the nfpm.yaml template with environment variables
 envsubst < /app/resources/nfpm.yaml > /app/nfpm.yaml

-nfpm pkg --config /app/nfpm.yaml --target /app/dist --packager rpm
+nfpm pkg --config /app/nfpm.yaml --target /app/dist --packager rpm
@@ -10,4 +10,4 @@ tar xf vlutils-linux-amd64-v${PACKAGE_VERSION}.tar.gz
 # Process the nfpm.yaml template with environment variables
 envsubst < /app/resources/nfpm.yaml > /app/nfpm.yaml

-nfpm pkg --config /app/nfpm.yaml --target /app/dist --packager rpm
+nfpm pkg --config /app/nfpm.yaml --target /app/dist --packager rpm
@@ -10,4 +10,4 @@ tar xf vmutils-linux-amd64-v${PACKAGE_VERSION}.tar.gz
 # Process the nfpm.yaml template with environment variables
 envsubst < /app/resources/nfpm.yaml > /app/nfpm.yaml

-nfpm pkg --config /app/nfpm.yaml --target /app/dist --packager rpm
+nfpm pkg --config /app/nfpm.yaml --target /app/dist --packager rpm
@@ -11,4 +11,4 @@ mv /app/xh-v${PACKAGE_VERSION}-x86_64-unknown-linux-musl/* /app/
 envsubst < /app/resources/nfpm.yaml > /app/nfpm.yaml

 # Build the RPM
-nfpm pkg --config /app/nfpm.yaml --target /app/dist --packager rpm
+nfpm pkg --config /app/nfpm.yaml --target /app/dist --packager rpm
@@ -626,6 +626,25 @@ def check_native_build_deps() -> bool:
    return True


+def check_buildah_available() -> bool:
+    """
+    Check if Buildah is available.
+
+    Returns:
+        True if Buildah is available, False otherwise
+    """
+    try:
+        result = subprocess.run(
+            ['buildah', 'version'],
+            capture_output=True,
+            text=True,
+            timeout=10
+        )
+        return result.returncode == 0
+    except (subprocess.TimeoutExpired, FileNotFoundError):
+        return False
+
+
 def cleanup_container(container_name: str) -> None:
    """
    Remove a Docker container.
@@ -750,6 +769,7 @@ def build_package_docker(
        build_args = [
            'docker', 'build',
            '--pull',
+            '--network=host',
            '-f', str(central_dockerfile),
            '--build-arg', f'BASE_IMAGE={base_image}',
            '--build-arg', f'PACKAGE_NAME={package_name}',
@@ -782,6 +802,7 @@ def build_package_docker(
        # Step 2: Create and start container
        create_args = [
            'docker', 'create',
+            '--network=host',
            '--name', container_name,
            image_name
        ]
@@ -958,6 +979,177 @@ def build_package_native(
        return False


+def build_package_buildah(
+    package_dir: Path,
+    package_name: str,
+    package_version: str,
+    package_release: str,
+    dist_dir: Path,
+    repository: str,
+    base_image: str = "git.unkin.net/unkin/almalinux9-rpmbuilder:latest",
+    dry_run: bool = False
+) -> bool:
+    """
+    Build a package using Buildah without Docker daemon.
+
+    Args:
+        package_dir: Directory containing the package resources
+        package_name: Name of the package
+        package_version: Package version
+        package_release: Package release number
+        dist_dir: Directory to store built packages
+        repository: Repository path (e.g., 'almalinux/el9')
+        base_image: Base Docker image to use for building
+        dry_run: If True, only show what would be done
+
+    Returns:
+        True if build succeeded, False otherwise
+    """
+    logger = logging.getLogger(__name__)
+
+    try:
+        # Ensure dist directory exists with repository structure
+        package_dist_dir = dist_dir / repository
+        if not dry_run:
+            package_dist_dir.mkdir(parents=True, exist_ok=True)
+
+        # Generate container name
+        container_name = f"{package_name}-{package_version}-buildah"
+
+        # Read metadata.yaml to get all package fields
+        metadata_file = package_dir / "metadata.yaml"
+        metadata = {}
+        if metadata_file.exists():
+            try:
+                with open(metadata_file, 'r') as f:
+                    metadata = yaml.safe_load(f) or {}
+            except Exception as e:
+                logger.warning(f"Could not read metadata.yaml: {e}")
+
+        logger.info(f"Building RPM for {package_name} version {package_version} using Buildah")
+
+        if dry_run:
+            logger.info(f"[DRY RUN] Would use Buildah to build from: {base_image}")
+            logger.info("[DRY RUN] Would set environment variables:")
+            logger.info(f"[DRY RUN]   PACKAGE_NAME={package_name}")
+            logger.info(f"[DRY RUN]   PACKAGE_VERSION={package_version}")
+            logger.info(f"[DRY RUN]   PACKAGE_RELEASE={package_release}")
+            logger.info(f"[DRY RUN] Would copy artifacts to: {package_dist_dir}")
+            return True
+
+        try:
+            # Step 1: Create a working container from base image
+            from_args = ['buildah', 'from', '--name', container_name, base_image]
+            logger.debug(f"Running: {' '.join(from_args)}")
+            result = subprocess.run(from_args, capture_output=True, text=True)
+
+            if result.returncode != 0:
+                logger.error(f"Failed to create Buildah container from {base_image}")
+                logger.error(f"stderr: {result.stderr}")
+                return False
+
+            # Step 2: Set environment variables
+            env_vars = {
+                'PACKAGE_NAME': package_name,
+                'PACKAGE_VERSION': package_version,
+                'PACKAGE_RELEASE': package_release,
+                'PACKAGE_DESCRIPTION': metadata.get('description', ''),
+                'PACKAGE_MAINTAINER': metadata.get('maintainer', ''),
+                'PACKAGE_HOMEPAGE': metadata.get('homepage', ''),
+                'PACKAGE_LICENSE': metadata.get('license', ''),
+                'PACKAGE_ARCH': metadata.get('arch', 'amd64'),
+                'PACKAGE_PLATFORM': metadata.get('platform', 'linux')
+            }
+
+            for key, value in env_vars.items():
+                config_args = ['buildah', 'config', '--env', f'{key}={value}', container_name]
+                logger.debug(f"Running: {' '.join(config_args)}")
+                result = subprocess.run(config_args, capture_output=True, text=True)
+                if result.returncode != 0:
+                    logger.error(f"Failed to set environment variable {key}")
+                    return False
+
+            # Step 3: Copy resources to container
+            copy_args = [
+                'buildah', 'copy', container_name,
+                str(package_dir / "resources"), '/app/resources'
+            ]
+            logger.debug(f"Running: {' '.join(copy_args)}")
+            result = subprocess.run(copy_args, capture_output=True, text=True)
+
+            if result.returncode != 0:
+                logger.error(f"Failed to copy resources to container")
+                logger.error(f"stderr: {result.stderr}")
+                return False
+
+            # Step 4: Create dist directory in container
+            run_args = ['buildah', 'run', container_name, 'mkdir', '-p', '/app/dist']
+            logger.debug(f"Running: {' '.join(run_args)}")
+            result = subprocess.run(run_args, capture_output=True, text=True)
+
+            # Step 5: Run the build script
+            run_args = ['buildah', 'run', '--workingdir', '/app', container_name, '/app/resources/build.sh']
+            logger.debug(f"Running: {' '.join(run_args)}")
+            result = subprocess.run(run_args, capture_output=True, text=True)
+
+            if result.returncode != 0:
+                logger.error(f"Buildah build script failed for {package_name}")
+                logger.error(f"stdout: {result.stdout}")
+                logger.error(f"stderr: {result.stderr}")
+                return False
+
+            # Step 6: Copy artifacts from container to host
+            copy_out_args = [
+                'buildah', 'run', container_name,
+                'find', '/app/dist', '-type', 'f', '-name', '*.rpm'
+            ]
+            result = subprocess.run(copy_out_args, capture_output=True, text=True)
+            logger.debug(f"Find RPMs result: {result.stdout}")
+
+            if result.returncode == 0 and result.stdout.strip():
+                rpm_files = result.stdout.strip().split('\n')
+                logger.info(f"Found {len(rpm_files)} RPM files to copy")
+
+                for rpm_file in rpm_files:
+                    rpm_file = rpm_file.strip()
+                    if rpm_file:
+                        # Use buildah mount to copy files out
+                        mount_args = ['buildah', 'mount', container_name]
+                        mount_result = subprocess.run(mount_args, capture_output=True, text=True)
+
+                        if mount_result.returncode == 0:
+                            container_path = mount_result.stdout.strip()
+                            source_file = Path(container_path) / rpm_file.lstrip('/')
+
+                            if source_file.exists():
+                                import shutil
+                                dest_file = package_dist_dir / source_file.name
+                                shutil.copy2(source_file, dest_file)
+                                logger.debug(f"Copied {source_file} to {dest_file}")
+                            else:
+                                logger.error(f"Source file not found: {source_file}")
+
+                            # Unmount
+                            subprocess.run(['buildah', 'unmount', container_name], capture_output=True)
+                        else:
+                            logger.error(f"Failed to mount container: {mount_result.stderr}")
+            else:
+                logger.warning(f"No RPM files found or find command failed: {result.stderr}")
+
+            logger.info(f"Successfully built {package_name}-{package_version}-{package_release} using Buildah")
+            return True
+
+        finally:
+            # Step 7: Clean up container
+            rm_args = ['buildah', 'rm', container_name]
+            logger.debug(f"Running: {' '.join(rm_args)}")
+            subprocess.run(rm_args, capture_output=True, text=True)
+
+    except Exception as e:
+        logger.error(f"Unexpected error building {package_name} with Buildah: {e}")
+        return False
+
+
 def cleanup_images(image_pattern: str = "*-builder") -> None:
    """
    Clean up Docker images matching a pattern.
@@ -1099,7 +1291,8 @@ class Builder:
        dry_run: bool = False,
        force: bool = False,
        distro: str = 'almalinux/el9',
-        native: bool = False
+        native: bool = False,
+        buildah: bool = False
    ) -> bool:
        """
        Build a single package.
@@ -1175,9 +1368,9 @@ class Builder:
            return False

        package_info = PackageInfo(package, version, release, package_dir, distro, base_image)
-        return self._build_package(package_info, dry_run, force, native)
+        return self._build_package(package_info, dry_run, force, native, buildah)

-    def build_all(self, dry_run: bool = False, force: bool = False, parallel: int = 4, distro: str = 'el/9', native: bool = False) -> bool:
+    def build_all(self, dry_run: bool = False, force: bool = False, parallel: int = 4, distro: str = 'el/9', native: bool = False, buildah: bool = False) -> bool:
        """
        Build all packages.

@@ -1199,29 +1392,29 @@ class Builder:
        self.logger.info(f"Found {len(packages)} packages to process")

        if parallel == 1:
-            return self._build_sequential(packages, dry_run, force, native)
+            return self._build_sequential(packages, dry_run, force, native, buildah)
        else:
-            return self._build_parallel(packages, dry_run, force, parallel, native)
+            return self._build_parallel(packages, dry_run, force, parallel, native, buildah)

-    def _build_sequential(self, packages: List[PackageInfo], dry_run: bool, force: bool, native: bool) -> bool:
+    def _build_sequential(self, packages: List[PackageInfo], dry_run: bool, force: bool, native: bool, buildah: bool) -> bool:
        """Build packages sequentially."""
        success_count = 0

        for package_info in packages:
-            if self._build_package(package_info, dry_run, force, native):
+            if self._build_package(package_info, dry_run, force, native, buildah):
                success_count += 1

        self.logger.info(f"Built {success_count}/{len(packages)} packages successfully")
        return success_count == len(packages)

-    def _build_parallel(self, packages: List[PackageInfo], dry_run: bool, force: bool, parallel: int, native: bool) -> bool:
+    def _build_parallel(self, packages: List[PackageInfo], dry_run: bool, force: bool, parallel: int, native: bool, buildah: bool) -> bool:
        """Build packages in parallel."""
        success_count = 0

        with ThreadPoolExecutor(max_workers=parallel) as executor:
            # Submit all build tasks
            future_to_package = {
-                executor.submit(self._build_package, pkg, dry_run, force, native): pkg
+                executor.submit(self._build_package, pkg, dry_run, force, native, buildah): pkg
                for pkg in packages
            }

@@ -1238,7 +1431,7 @@ class Builder:
        self.logger.info(f"Built {success_count}/{len(packages)} packages successfully")
        return success_count == len(packages)

-    def _build_package(self, package_info: PackageInfo, dry_run: bool, force: bool, native: bool = False) -> bool:
+    def _build_package(self, package_info: PackageInfo, dry_run: bool, force: bool, native: bool = False, buildah: bool = False) -> bool:
        """
        Build a single package.

@@ -1264,11 +1457,16 @@ class Builder:
                    return True

            # Check build tool availability (unless dry run)
-            use_native = native or check_native_build_deps()
-            use_docker = not use_native and check_docker_available()
+            use_native = native
+            use_buildah = buildah
+            use_docker = not use_native and not use_buildah and check_docker_available()
+            if not use_native and not use_buildah and not use_docker:
+                use_buildah = check_buildah_available()
+            if not use_native and not use_buildah and not use_docker:
+                use_native = check_native_build_deps()

-            if not dry_run and not use_native and not use_docker:
-                self.logger.error("Neither native build dependencies nor Docker is available")
+            if not dry_run and not use_native and not use_buildah and not use_docker:
+                self.logger.error("No build tools available (tried native, Buildah, Docker)")
                return False

            # Build the package using available tool
@@ -1283,6 +1481,18 @@ class Builder:
                    repository=package_info.distro,
                    dry_run=dry_run
                )
+            elif use_buildah:
+                self.logger.debug(f"Using Buildah to build {package_info.name}")
+                return build_package_buildah(
+                    package_dir=package_info.directory,
+                    package_name=package_info.name,
+                    package_version=package_info.version,
+                    package_release=package_info.release,
+                    dist_dir=self.dist_dir,
+                    repository=package_info.distro,
+                    base_image=package_info.base_image,
+                    dry_run=dry_run
+                )
            else:
                self.logger.debug(f"Using Docker to build {package_info.name}")
                return build_package_docker(
@@ -1557,6 +1767,7 @@ def build(
    dry_run: bool = typer.Option(False, "--dry-run", help="Show what would be built without building"),
    force: bool = typer.Option(False, "--force", help="Build even if package exists in registry"),
    native: bool = typer.Option(False, "--native", help="Force native build (skip Docker even if available)"),
+    buildah: bool = typer.Option(False, "--buildah", help="Force Buildah build (requires Buildah)"),
    verbose: bool = typer.Option(False, "--verbose", "-v", help="Enable verbose logging")
 ):
    """Build a specific package."""
@@ -1619,7 +1830,8 @@ def build(
            dry_run=dry_run,
            force=force,
            distro=distro,
-            native=native
+            native=native,
+            buildah=buildah
        )

        if not success:
@@ -1636,6 +1848,7 @@ def build_all(
    parallel: int = typer.Option(4, help="Number of parallel builds"),
    distro: str = typer.Option("almalinux/el9", help="Target distro (almalinux/el8, almalinux/el9, or 'all' for all distros)"),
    native: bool = typer.Option(False, "--native", help="Force native build (skip Docker even if available)"),
+    buildah: bool = typer.Option(False, "--buildah", help="Force Buildah build (requires Buildah)"),
    verbose: bool = typer.Option(False, "--verbose", "-v", help="Enable verbose logging")
 ):
    """Build all packages."""
@@ -1650,7 +1863,8 @@ def build_all(
            force=force,
            parallel=parallel,
            distro=distro,
-            native=native
+            native=native,
+            buildah=buildah
        )

        if not success:
@@ -154,6 +154,33 @@ def load_env_vars(env_file: Path) -> Dict[str, str]:
    return env_vars


+def get_claude_ai_latest_version() -> Optional[str]:
+    """
+    Get the latest claude-code version from downloads.claude.ai.
+
+    Returns:
+        Latest version string or None if not found
+    """
+    logger = logging.getLogger(__name__)
+
+    try:
+        url = "https://downloads.claude.ai/claude-code-releases/latest"
+        logger.debug(f"Checking claude-code latest version: {url}")
+        response = requests.get(url, timeout=30)
+
+        if response.status_code == 200:
+            version = response.text.strip()
+            logger.debug(f"Latest claude-code version: {version}")
+            return version
+        else:
+            logger.warning(f"Unexpected response from claude.ai: {response.status_code}")
+            return None
+
+    except requests.RequestException as e:
+        logger.error(f"Failed to check claude-code version: {e}")
+        return None
+
+
 def get_github_latest_release(repo: str) -> Optional[Dict]:
    """
    Get the latest release from GitHub API.
@@ -315,26 +342,30 @@ def check_package_updates(package_dir: Path, dry_run: bool = False) -> bool:
        package_name = metadata.get('name', package_dir.name)
        current_version = metadata.get('version')
        github_repo = metadata.get('github')
+        claude_ai = metadata.get('claude_ai', False)

-        if not github_repo:
-            logger.debug(f"Package {package_name} has no GitHub repo configured")
+        if not github_repo and not claude_ai:
+            logger.debug(f"Package {package_name} has no GitHub repo or claude_ai configured")
            return True

        if not current_version:
            logger.warning(f"Package {package_name} has no version in metadata")
            return False

-        logger.info(f"Checking {package_name} (current: {current_version}) from {github_repo}")
-
-        # Get latest release from GitHub
-        latest_release = get_github_latest_release(github_repo)
-        if not latest_release:
-            return False
-
-        latest_version = normalize_version(latest_release.get('tag_name', ''))
-        if not latest_version:
-            logger.warning(f"Could not determine latest version for {package_name}")
-            return False
+        if claude_ai:
+            logger.info(f"Checking {package_name} (current: {current_version}) from downloads.claude.ai")
+            latest_version = get_claude_ai_latest_version()
+            if not latest_version:
+                return False
+        else:
+            logger.info(f"Checking {package_name} (current: {current_version}) from {github_repo}")
+            latest_release = get_github_latest_release(github_repo)
+            if not latest_release:
+                return False
+            latest_version = normalize_version(latest_release.get('tag_name', ''))
+            if not latest_version:
+                logger.warning(f"Could not determine latest version for {package_name}")
+                return False

        # Compare versions
        if compare_versions(current_version, latest_version):
@@ -373,7 +404,7 @@ def find_packages_with_github(rpms_dir: Path) -> List[Path]:
            with open(metadata_file, 'r') as f:
                metadata = yaml.safe_load(f)

-            if metadata.get('github'):
+            if metadata.get('github') or metadata.get('claude_ai'):
                github_packages.append(package_dir)
        except Exception:
            continue
@@ -459,4 +490,4 @@ Examples:


 if __name__ == '__main__':
-    main()
+    main()
Author	SHA1	Message	Date
unkinben	06b1797537	Merge branch 'master' into benvin/tea ci/woodpecker/pr/pre-commit Pipeline was successful Details ci/woodpecker/pr/build-almalinux8 Pipeline was successful Details ci/woodpecker/pr/build-almalinux9 Pipeline was successful Details	2026-04-26 21:21:16 +10:00
unkinben	0fd817b13f	Merge pull request 'benvin/escape_secret' (#113 ) from benvin/escape_secret into master ci/woodpecker/push/deploy-almalinux9 Pipeline was successful Details ci/woodpecker/push/deploy-almalinux8 Pipeline was successful Details Reviewed-on: #113	2026-04-26 21:11:29 +10:00
unkinben	c7eddffbb3	fix: uploads fail with wrong password ci/woodpecker/pr/pre-commit Pipeline was successful Details ci/woodpecker/pr/build-almalinux8 Pipeline was successful Details ci/woodpecker/pr/build-almalinux9 Pipeline was successful Details - properly escape the ${} function	2026-04-26 21:07:49 +10:00
unkinben	17e0fadd44	feat: add tea rpm	2026-04-26 21:07:49 +10:00
unkinben	cfd1972d54	Merge pull request 'feat: add stern rpm' (#102 ) from benvin/stern into master ci/woodpecker/push/deploy-almalinux8 Pipeline was successful Details ci/woodpecker/push/deploy-almalinux9 Pipeline was successful Details Reviewed-on: #102	2026-04-26 19:50:59 +10:00
unkinben	8cbd495004	feat: add tea rpm ci/woodpecker/pr/pre-commit Pipeline was successful Details ci/woodpecker/pr/build-almalinux9 Pipeline was successful Details ci/woodpecker/pr/build-almalinux8 Pipeline was successful Details	2026-04-26 16:58:37 +10:00
unkinben	e04f19ed03	feat: add stern rpm ci/woodpecker/pr/pre-commit Pipeline was successful Details ci/woodpecker/pr/build-almalinux8 Pipeline was successful Details ci/woodpecker/pr/build-almalinux9 Pipeline was successful Details	2026-04-26 16:23:01 +10:00
unkinben	ff054f42bb	Merge pull request 'fix: add --network=host to docker and fix build tool fallback order' (#89 ) from fix/docker-network-host-and-tool-detection into master ci/woodpecker/push/deploy-almalinux8 Pipeline was successful Details ci/woodpecker/push/deploy-almalinux9 Pipeline was successful Details Reviewed-on: #89	2026-04-25 16:14:57 +10:00
unkinben	818a48fa78	fix: add --network=host to docker and fix build tool fallback order ci/woodpecker/pr/pre-commit Pipeline was successful Details ci/woodpecker/pr/build-almalinux8 Pipeline was successful Details ci/woodpecker/pr/build-almalinux9 Pipeline was successful Details Pass --network=host to docker build and docker create so package builds can reach the network. Reorder auto-detection so Docker is tried before buildah/native, only falling back when the explicit flag is not set.	2026-04-25 16:11:40 +10:00
unkinben	111ea50d80	Merge pull request 'feat: automatically update claude-ai version' (#88 ) from benvin/claude-ai-versioncheck into master ci/woodpecker/push/deploy-almalinux8 Pipeline was successful Details ci/woodpecker/push/deploy-almalinux9 Pipeline was successful Details Reviewed-on: #88	2026-04-25 15:39:39 +10:00
unkinben	1b46845734	feat: automatically update claude-ai version ci/woodpecker/pr/pre-commit Pipeline was successful Details ci/woodpecker/pr/build-almalinux8 Pipeline was successful Details ci/woodpecker/pr/build-almalinux9 Pipeline was successful Details	2026-04-25 11:38:32 +10:00
unkinben	497b99c328	Merge pull request 'feat: add claude-code rpm' (#87 ) from benvin/claude-code into master ci/woodpecker/push/deploy-almalinux8 Pipeline was successful Details ci/woodpecker/push/deploy-almalinux9 Pipeline was successful Details Reviewed-on: #87	2026-04-25 11:37:22 +10:00
unkinben	6b070d8c14	feat: add claude-code rpm ci/woodpecker/pr/pre-commit Pipeline was successful Details ci/woodpecker/pr/build-almalinux9 Pipeline was successful Details ci/woodpecker/pr/build-almalinux8 Pipeline was successful Details	2026-04-25 11:32:10 +10:00
unkinben	dff743a00b	Merge pull request 'feat: migrate to woodpeckerci' (#83 ) from benvin/woodpecker_changes into master ci/woodpecker/push/deploy-almalinux9 Pipeline was successful Details ci/woodpecker/push/deploy-almalinux8 Pipeline was successful Details Reviewed-on: #83	2026-03-07 17:14:18 +11:00
unkinben	f408d3d705	feat: migrate to woodpeckerci ci/woodpecker/pr/pre-commit Pipeline was successful Details ci/woodpecker/pr/build-almalinux9 Pipeline was successful Details ci/woodpecker/pr/build-almalinux8 Pipeline was successful Details - update build tool for kubernetes auth - update build tool to build packages without docker (native + buildah) - add woodpecker pre-commit and build jobs - add woodpecker deployment jobs - cleanup gitea actions workflows	2026-03-07 17:11:20 +11:00
unkinben	c4c018b1ee	Merge pull request 'feat: additional pre-commit checks' (#86 ) from benvin/pre-commit-improvements into master Deploy / deploy-8 (push) Successful in 4s Details Deploy / deploy-9 (push) Successful in 3s Details Reviewed-on: #86	2026-03-07 17:06:30 +11:00
unkinben	b18e34c905	feat: additional pre-commit checks Build / build-8 (pull_request) Successful in 10s Details Build / build-9 (pull_request) Successful in 10s Details - add all precommit checks from pre-commit's hooks repo - ensure scripts with shebangs are executable	2026-03-07 17:04:48 +11:00
unkinben	cede57a565	Merge pull request 'fix: precommit fix all' (#85 ) from benvin/pre-commit-all into master Deploy / deploy-8 (push) Successful in 3s Details Deploy / deploy-9 (push) Successful in 3s Details Reviewed-on: #85	2026-03-07 12:30:01 +11:00
unkinben	07a75008a1	fix: precommit fix all Build / build-8 (pull_request) Successful in 12s Details Build / build-9 (pull_request) Successful in 13s Details - run pre-commit against all files - preparation for running pre-commit in ci	2026-03-07 12:28:20 +11:00
unkinben	5e1533289f	Merge pull request 'chore: bump rarlab version' (#84 ) from benvin/rarlab_fix into master Deploy / deploy-8 (push) Successful in 3s Details Deploy / deploy-9 (push) Successful in 3s Details Reviewed-on: #84	2026-03-07 12:27:25 +11:00
unkinben	cd1eb1f46c	chore: bump rarlab version Build / build-8 (pull_request) Successful in 16s Details Build / build-9 (pull_request) Successful in 17s Details - release 7.20 - use artifactapi caching	2026-03-07 12:15:19 +11:00