Merge branch 'master' into benvin/tea

Reviewed-on: #113

.gitea/workflows/build.yaml

@@ -1,59 +0,0 @@
-name: Build
-
-on:
-  pull_request:
-  workflow_call:
-  workflow_dispatch:
-
-jobs:
-  build-8:
-    runs-on: almalinux-8
-    container:
-      image: git.unkin.net/unkin/almalinux8-actionsdind:latest
-      options: "--privileged --volume /etc/pki/tls/vault:/etc/pki/tls/vault:ro"
-
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v3
-
-      - name: Build Packages
-        env:
-          VAULT_ROLE_ID: ${{ secrets.RPMBUILDER_VAULT_ROLEID }}
-        run: |
-          ./tools/build build-all --distro almalinux/el8
-
-      - name: Show RPMs
-        run: |
-          find /workspace -type f -name "*.rpm"
-
-      - name: Upload Artifacts
-        uses: actions/upload-artifact@v3
-        with:
-          name: rpms-8
-          path: /workspace/unkin/rpmbuilder/dist/*/*/*.rpm
-
-  build-9:
-    runs-on: almalinux-8
-    container:
-      image: git.unkin.net/unkin/almalinux9-actionsdind:latest
-      options: "--privileged --volume /etc/pki/tls/vault:/etc/pki/tls/vault:ro"
-
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v3
-
-      - name: Build Packages
-        env:
-          VAULT_ROLE_ID: ${{ secrets.RPMBUILDER_VAULT_ROLEID }}
-        run: |
-          ./tools/build build-all --distro almalinux/el9
-
-      - name: Show RPMs
-        run: |
-          find /workspace -type f -name "*.rpm"
-
-      - name: Upload Artifacts
-        uses: actions/upload-artifact@v3
-        with:
-          name: rpms-9
-          path: /workspace/unkin/rpmbuilder/dist/*/*/*.rpm

.gitea/workflows/deploy.yaml

@@ -1,66 +0,0 @@
-name: Deploy
-
-on:
-  push:
-    branches:
-      - master
-  workflow_dispatch:
-
-jobs:
-  deploy-8:
-    runs-on: almalinux-8
-    container:
-      image: git.unkin.net/unkin/almalinux8-actionsdind:latest
-      options: --privileged
-
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v3
-
-      - name: Download Artifacts
-        run: |
-          mkdir -p /workspace/unkin/rpmbuilder/dist/almalinux/el8
-          export PREVIOUS_RUN_ID=$((GITHUB_RUN_NUMBER - 1))
-          curl -L -o /workspace/rpms.zip "https://git.unkin.net/${GITHUB_REPOSITORY}/actions/runs/${PREVIOUS_RUN_ID}/artifacts/rpms-8"
-          unzip /workspace/rpms.zip -d /workspace/unkin/rpmbuilder/dist/almalinux/el8
-
-      - name: Show RPMs
-        run: |
-          find /workspace -type f -name "*.rpm"
-
-      - name: Upload RPMs to Gitea
-        env:
-          DRONECI_PASSWORD: ${{ secrets.DRONECI_PASSWORD }}
-        run: |
-          for rpm in $(find /workspace/unkin/rpmbuilder/dist/almalinux/el8 -type f -name "*.rpm"); do
-            curl --user droneci:${{ secrets.DRONECI_PASSWORD }} --upload-file $rpm https://git.unkin.net/api/packages/unkin/rpm/almalinux/el8/upload
-          done
-
-  deploy-9:
-    runs-on: almalinux-8
-    container:
-      image: git.unkin.net/unkin/almalinux9-actionsdind:latest
-      options: --privileged
-
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v3
-
-      - name: Download Artifacts
-        run: |
-          mkdir -p /workspace/unkin/rpmbuilder/dist/almalinux/el9
-          export PREVIOUS_RUN_ID=$((GITHUB_RUN_NUMBER - 1))
-          curl -L -o /workspace/rpms.zip "https://git.unkin.net/${GITHUB_REPOSITORY}/actions/runs/${PREVIOUS_RUN_ID}/artifacts/rpms-9"
-          unzip /workspace/rpms.zip -d /workspace/unkin/rpmbuilder/dist/almalinux/el9
-
-      - name: Show RPMs
-        run: |
-          find /workspace -type f -name "*.rpm"
-
-      - name: Upload RPMs to Gitea
-        env:
-          DRONECI_PASSWORD: ${{ secrets.DRONECI_PASSWORD }}
-        run: |
-          for rpm in $(find /workspace/unkin/rpmbuilder/dist/almalinux/el9 -type f -name "*.rpm"); do
-            curl --user droneci:${{ secrets.DRONECI_PASSWORD }} --upload-file $rpm https://git.unkin.net/api/packages/unkin/rpm/almalinux/el9/upload
-          done

.pre-commit-config.yaml

@@ -3,12 +3,24 @@ repos:
   - repo: https://github.com/pre-commit/pre-commit-hooks
     rev: v4.5.0
     hooks:
-      - id: trailing-whitespace
+      - id: check-executables-have-shebangs
-      - id: end-of-file-fixer
+      - id: check-json
+      - id: check-added-large-files
+        args: ['--maxkb=500']
+      - id: check-merge-conflict
+      - id: check-shebang-scripts-are-executable
+      - id: check-symlinks
+      - id: check-toml
       - id: check-yaml
         args: [--allow-multiple-documents]
-      - id: check-merge-conflict
+      - id: detect-aws-credentials
+        args: [--allow-missing-credentials]
       - id: detect-private-key
+      - id: end-of-file-fixer
+      - id: forbid-new-submodules
+      - id: pretty-format-json
+      - id: trailing-whitespace
+
   - repo: https://github.com/adrienverge/yamllint.git
     rev: v1.37.1
     hooks:
@@ -18,6 +30,7 @@ repos:
             "-d {extends: relaxed, rules: {line-length: disable}}",
             "-s",
           ]
+
   - repo: https://github.com/astral-sh/ruff-pre-commit
     rev: v0.14.7
     hooks:

.woodpecker/build-almalinux8.yaml

@@ -0,0 +1,20 @@
+when:
+  - event: pull_request
+
+steps:
+  - name: build rpms
+    image: git.unkin.net/unkin/almalinux9-rpmbuilder:latest
+    commands:
+      - mkdir -p /woodpecker/rpms
+      - ln -s /woodpecker/rpms /workspace
+      - dnf install buildah -y
+      - ./tools/build build-all --distro almalinux/el8 --buildah
+    privileged: true
+    backend_options:
+      kubernetes:
+        serviceAccountName: default
+
+  - name: show rpms
+    image: git.unkin.net/unkin/almalinux8-base:latest
+    commands:
+      - find /woodpecker/src/git.unkin.net/unkin/rpmbuilder/ -type f -name "*.rpm"

.woodpecker/build-almalinux9.yaml

@@ -0,0 +1,20 @@
+when:
+  - event: pull_request
+
+steps:
+  - name: build rpms
+    image: git.unkin.net/unkin/almalinux9-rpmbuilder:latest
+    commands:
+      - mkdir -p /woodpecker/rpms
+      - ln -s /woodpecker/rpms /workspace
+      - dnf install buildah -y
+      - ./tools/build build-all --distro almalinux/el9 --buildah
+    privileged: true
+    backend_options:
+      kubernetes:
+        serviceAccountName: default
+
+  - name: show rpms
+    image: git.unkin.net/unkin/almalinux9-base:latest
+    commands:
+      - find /woodpecker/src/git.unkin.net/unkin/rpmbuilder/ -type f -name "*.rpm"

.woodpecker/deploy-almalinux8.yaml

@@ -0,0 +1,37 @@
+when:
+  - event: push
+    branch: master
+
+steps:
+  - name: build-rpms
+    image: git.unkin.net/unkin/almalinux9-rpmbuilder:latest
+    commands:
+      - mkdir -p /woodpecker/rpms
+      - ln -s /woodpecker/rpms /workspace
+      - dnf install buildah -y
+      - ./tools/build build-all --distro almalinux/el8 --buildah
+    privileged: true
+    backend_options:
+      kubernetes:
+        serviceAccountName: default
+
+  - name: show-rpms
+    image: git.unkin.net/unkin/almalinux9-base:latest
+    commands:
+      - find /woodpecker/src/git.unkin.net/unkin/rpmbuilder/ -type f -name "*.rpm"
+    depends_on: [build-rpms]
+
+  - name: deploy-rpms
+    image: git.unkin.net/unkin/almalinux9-rpmbuilder:latest
+    commands:
+      - |
+        for rpm in $(find /woodpecker/src/git.unkin.net/unkin/rpmbuilder/ -type f -name "*.rpm"); do
+          curl --user droneci:$${DRONECI_PASSWORD} --upload-file $rpm https://git.unkin.net/api/packages/unkin/rpm/almalinux/el8/upload
+        done
+    environment:
+      DRONECI_PASSWORD:
+        from_secret: DRONECI_PASSWORD
+    backend_options:
+      kubernetes:
+        serviceAccountName: default
+    depends_on: [build-rpms, show-rpms]

.woodpecker/deploy-almalinux9.yaml

@@ -0,0 +1,37 @@
+when:
+  - event: push
+    branch: master
+
+steps:
+  - name: build-rpms
+    image: git.unkin.net/unkin/almalinux9-rpmbuilder:latest
+    commands:
+      - mkdir -p /woodpecker/rpms
+      - ln -s /woodpecker/rpms /workspace
+      - dnf install buildah -y
+      - ./tools/build build-all --distro almalinux/el9 --buildah
+    privileged: true
+    backend_options:
+      kubernetes:
+        serviceAccountName: default
+
+  - name: show-rpms
+    image: git.unkin.net/unkin/almalinux9-base:latest
+    commands:
+      - find /woodpecker/src/git.unkin.net/unkin/rpmbuilder/ -type f -name "*.rpm"
+    depends_on: [build-rpms]
+
+  - name: deploy-rpms
+    image: git.unkin.net/unkin/almalinux9-rpmbuilder:latest
+    commands:
+      - |
+        for rpm in $(find /woodpecker/src/git.unkin.net/unkin/rpmbuilder/ -type f -name "*.rpm"); do
+          curl --user droneci:$${DRONECI_PASSWORD} --upload-file $rpm https://git.unkin.net/api/packages/unkin/rpm/almalinux/el9/upload
+        done
+    environment:
+      DRONECI_PASSWORD:
+        from_secret: DRONECI_PASSWORD
+    backend_options:
+      kubernetes:
+        serviceAccountName: default
+    depends_on: [build-rpms, show-rpms]

.woodpecker/pre-commit.yaml

@@ -0,0 +1,9 @@
+when:
+  - event: pull_request
+
+steps:
+  - name: pre-commit
+    image: git.unkin.net/unkin/almalinux9-base:latest
+    commands:
+      - dnf install uv make -y
+      - uvx pre-commit run --all-files

Makefile

@@ -3,6 +3,10 @@ ROOT_DIR := $(PWD)
 BUILD_TOOL := $(ROOT_DIR)/tools/build
 DISTRO ?= almalinux/el9
 
+# Authentication variables (optional)
+# VAULT_ROLE_ID - Use AppRole authentication if set
+# VAULT_ROLE - Kubernetes role for service account authentication (default: rpmbuilder)
+
 # Automatically find all packages with metadata.yaml
 PACKAGES := $(shell find $(ROOT_DIR)/rpms -mindepth 1 -maxdepth 1 -type d -exec test -f {}/metadata.yaml \; -print | xargs -n1 basename | sort)
 
@@ -22,6 +26,16 @@ build-all:
 	@echo "Building all packages using Python tooling for distro $(DISTRO)..."
 	$(BUILD_TOOL) build-all --distro $(DISTRO)
 
+# Build all packages using native build (no Docker)
+build-all-native:
+	@echo "Building all packages natively (no Docker) for distro $(DISTRO)..."
+	$(BUILD_TOOL) build-all --distro $(DISTRO) --native
+
+# Build all packages using Buildah
+build-all-buildah:
+	@echo "Building all packages using Buildah for distro $(DISTRO)..."
+	$(BUILD_TOOL) build-all --distro $(DISTRO) --buildah
+
 # Build specific package using Python tool
 .PHONY: $(PACKAGES)
 $(PACKAGES):

rpms/claude-code/metadata.yaml

@@ -0,0 +1,18 @@
+---
+arch: amd64
+builds:
+  - image: git.unkin.net/unkin/almalinux8-rpmbuilder:latest
+    release: '1'
+    repository: [almalinux/el8]
+    version: 2.1.120
+  - image: git.unkin.net/unkin/almalinux9-rpmbuilder:latest
+    release: '1'
+    repository: [almalinux/el9]
+    version: 2.1.120
+claude_ai: true
+description: Claude Code - Anthropic's agentic AI coding tool
+homepage: https://claude.ai/code
+license: Proprietary
+maintainer: Anthropic
+name: claude-code
+platform: linux

rpms/claude-code/resources/build.sh

@@ -0,0 +1,13 @@
+#!/usr/bin/bash
+
+set -e
+
+# Download claude-code binary
+wget -O /app/claude https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/claude-ai/claude-code-releases/${PACKAGE_VERSION}/linux-x64/claude
+chmod +x /app/claude
+
+# Process the nfpm.yaml template with environment variables
+envsubst < /app/resources/nfpm.yaml > /app/nfpm.yaml
+
+# Build the RPM
+nfpm pkg --config /app/nfpm.yaml --target /app/dist --packager rpm

rpms/claude-code/resources/nfpm.yaml

@@ -0,0 +1,33 @@
+# nfpm.yaml
+
+name: ${PACKAGE_NAME}
+version: ${PACKAGE_VERSION}
+release: ${PACKAGE_RELEASE}
+arch: ${PACKAGE_ARCH}
+platform: ${PACKAGE_PLATFORM}
+section: default
+priority: extra
+description: "${PACKAGE_DESCRIPTION}"
+
+maintainer: ${PACKAGE_MAINTAINER}
+homepage: ${PACKAGE_HOMEPAGE}
+license: ${PACKAGE_LICENSE}
+
+disable_globbing: false
+
+replaces:
+  - claude-code
+  - claude
+
+provides:
+  - claude-code
+  - claude
+
+# Files to include in the package
+contents:
+  - src: /app/claude
+    dst: /usr/bin/claude
+    file_info:
+      mode: 0755
+      owner: root
+      group: root

rpms/stern/metadata.yaml

@@ -0,0 +1,20 @@
+---
+name: stern
+github: stern/stern
+description: Multi pod and container log tailing for Kubernetes.
+arch: amd64
+platform: linux
+maintainer: stern
+homepage: https://github.com/stern/stern
+license: Apache-2.0
+builds:
+- repository:
+  - almalinux/el8
+  image: git.unkin.net/unkin/almalinux8-rpmbuilder:latest
+  release: 1
+  version: 1.33.1
+- repository:
+  - almalinux/el9
+  image: git.unkin.net/unkin/almalinux9-rpmbuilder:latest
+  release: 1
+  version: 1.33.1

rpms/stern/resources/build.sh

@@ -0,0 +1,10 @@
+#!/usr/bin/bash
+
+set -e
+
+wget -O /app/stern_${PACKAGE_VERSION}_linux_amd64.tar.gz https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/github/stern/stern/releases/download/v${PACKAGE_VERSION}/stern_${PACKAGE_VERSION}_linux_amd64.tar.gz
+tar xf /app/stern_${PACKAGE_VERSION}_linux_amd64.tar.gz
+
+envsubst < /app/resources/nfpm.yaml > /app/nfpm.yaml
+
+nfpm pkg --config /app/nfpm.yaml --target /app/dist --packager rpm

rpms/stern/resources/nfpm.yaml

@@ -0,0 +1,30 @@
+# nfpm.yaml
+
+name: ${PACKAGE_NAME}
+version: ${PACKAGE_VERSION}
+release: ${PACKAGE_RELEASE}
+arch: ${PACKAGE_ARCH}
+platform: ${PACKAGE_PLATFORM}
+section: default
+priority: extra
+description: "${PACKAGE_DESCRIPTION}"
+
+maintainer: ${PACKAGE_MAINTAINER}
+homepage: ${PACKAGE_HOMEPAGE}
+license: ${PACKAGE_LICENSE}
+
+disable_globbing: false
+
+replaces:
+  - stern
+
+provides:
+  - stern
+
+contents:
+  - src: /app/stern
+    dst: /usr/bin/stern
+    file_info:
+      mode: 0755
+      owner: root
+      group: root

rpms/tea/metadata.yaml

@@ -0,0 +1,20 @@
+---
+name: tea
+github: unknown/tea
+description: The official CLI for Gitea.
+arch: amd64
+platform: linux
+maintainer: Gitea
+homepage: https://gitea.com/gitea/tea
+license: MIT
+builds:
+- repository:
+  - almalinux/el8
+  image: git.unkin.net/unkin/almalinux8-rpmbuilder:latest
+  release: 1
+  version: 0.14.0
+- repository:
+  - almalinux/el9
+  image: git.unkin.net/unkin/almalinux9-rpmbuilder:latest
+  release: 1
+  version: 0.14.0

rpms/tea/resources/build.sh

@@ -0,0 +1,10 @@
+#!/usr/bin/bash
+
+set -e
+
+curl -L --output /app/tea-linux-amd64 https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/gitea-dl/tea/${PACKAGE_VERSION}/tea-${PACKAGE_VERSION}-linux-amd64
+chmod +x /app/tea-linux-amd64
+
+envsubst < /app/resources/nfpm.yaml > /app/nfpm.yaml
+
+nfpm pkg --config /app/nfpm.yaml --target /app/dist --packager rpm

rpms/tea/resources/nfpm.yaml

@@ -0,0 +1,30 @@
+# nfpm.yaml
+
+name: ${PACKAGE_NAME}
+version: ${PACKAGE_VERSION}
+release: ${PACKAGE_RELEASE}
+arch: ${PACKAGE_ARCH}
+platform: ${PACKAGE_PLATFORM}
+section: default
+priority: extra
+description: "${PACKAGE_DESCRIPTION}"
+
+maintainer: ${PACKAGE_MAINTAINER}
+homepage: ${PACKAGE_HOMEPAGE}
+license: ${PACKAGE_LICENSE}
+
+disable_globbing: false
+
+replaces:
+  - tea
+
+provides:
+  - tea
+
+contents:
+  - src: /app/tea-linux-amd64
+    dst: /usr/bin/tea
+    file_info:
+      mode: 0755
+      owner: root
+      group: root

rpms/unrar/resources/build.sh

@@ -5,7 +5,7 @@ set -e
 # Download and extract unrar (with version formatting)
 export DOWNLOAD_VERSION=$(echo $PACKAGE_VERSION | sed s/\\.//)
 curl -L -o /app/rarlinux.tar.gz https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/rarlab/rar/rarlinux-x64-${DOWNLOAD_VERSION}.tar.gz
-tar xf /app/rarlinux.tar.gz
+tar xf /app/rarlinux.tar.gz -C /app
 mv /app/rar/unrar /app/
 
 # Process the nfpm.yaml template with environment variables

tools/build

@@ -156,7 +156,7 @@ class PackageMetadata:
 
 def get_vault_client() -> hvac.Client:
     """
-    Initialize and authenticate Vault client using AppRole authentication.
+    Initialize and authenticate Vault client using AppRole or Kubernetes authentication.
 
     Returns:
         Authenticated HVAC client
@@ -166,10 +166,7 @@ def get_vault_client() -> hvac.Client:
     # Get required environment variables
     vault_addr = os.getenv('VAULT_ADDR', 'https://vault.service.consul:8200')
     vault_role_id = os.getenv('VAULT_ROLE_ID')
-
+    vault_role = os.getenv('VAULT_ROLE', 'rpmbuilder')
-    if not vault_role_id:
-        logger.error("VAULT_ROLE_ID environment variable is required")
-        sys.exit(1)
 
     # Initialize Vault client with CA certificate
     client = hvac.Client(
@@ -177,21 +174,55 @@ def get_vault_client() -> hvac.Client:
         verify='/etc/pki/tls/cert.pem'
     )
 
-    # Authenticate using AppRole
+    # Use AppRole authentication if VAULT_ROLE_ID is available
-    try:
+    if vault_role_id:
-        logger.debug(f"Authenticating to Vault at {vault_addr}")
+        try:
-        client.auth.approle.login(role_id=vault_role_id)
+            logger.debug(f"Authenticating to Vault at {vault_addr} using AppRole")
+            client.auth.approle.login(role_id=vault_role_id)
 
-        if not client.is_authenticated():
+            if not client.is_authenticated():
-            logger.error("Failed to authenticate with Vault")
+                logger.error("Failed to authenticate with Vault using AppRole")
+                sys.exit(1)
+
+            logger.debug("Successfully authenticated with Vault using AppRole")
+            return client
+
+        except Exception as e:
+            logger.error(f"AppRole authentication failed: {e}")
             sys.exit(1)
 
-        logger.debug("Successfully authenticated with Vault")
+    # Fallback to Kubernetes authentication if service account token is available
-        return client
+    service_account_token_path = '/var/run/secrets/kubernetes.io/serviceaccount/token'
 
-    except Exception as e:
+    if os.path.exists(service_account_token_path):
-        logger.error(f"Vault authentication failed: {e}")
+        try:
-        sys.exit(1)
+            logger.debug(f"Attempting Kubernetes authentication to Vault at {vault_addr}")
+
+            # Read the service account token
+            with open(service_account_token_path, 'r') as f:
+                jwt_token = f.read().strip()
+
+            # Authenticate using Kubernetes auth method
+            client.auth.kubernetes.login(
+                role=vault_role,
+                jwt=jwt_token,
+                mount_point='k8s/au/syd1'
+            )
+
+            if not client.is_authenticated():
+                logger.error("Failed to authenticate with Vault using Kubernetes auth")
+                sys.exit(1)
+
+            logger.debug("Successfully authenticated with Vault using Kubernetes auth")
+            return client
+
+        except Exception as e:
+            logger.error(f"Kubernetes authentication failed: {e}")
+            sys.exit(1)
+
+    # No authentication method available
+    logger.error("Neither VAULT_ROLE_ID environment variable nor Kubernetes service account token is available")
+    sys.exit(1)
 
 
 def get_gitea_token() -> str:
@@ -570,6 +601,50 @@ def check_docker_available() -> bool:
         return False
 
 
+def check_native_build_deps() -> bool:
+    """
+    Check if native build dependencies are available (nfpm, envsubst, etc.).
+
+    Returns:
+        True if native build dependencies are available, False otherwise
+    """
+    required_commands = ['nfpm', 'envsubst', 'wget', 'tar']
+
+    for cmd in required_commands:
+        try:
+            result = subprocess.run(
+                [cmd, '--version'],
+                capture_output=True,
+                text=True,
+                timeout=5
+            )
+            if result.returncode != 0:
+                return False
+        except (subprocess.TimeoutExpired, FileNotFoundError):
+            return False
+
+    return True
+
+
+def check_buildah_available() -> bool:
+    """
+    Check if Buildah is available.
+
+    Returns:
+        True if Buildah is available, False otherwise
+    """
+    try:
+        result = subprocess.run(
+            ['buildah', 'version'],
+            capture_output=True,
+            text=True,
+            timeout=10
+        )
+        return result.returncode == 0
+    except (subprocess.TimeoutExpired, FileNotFoundError):
+        return False
+
+
 def cleanup_container(container_name: str) -> None:
     """
     Remove a Docker container.
@@ -694,6 +769,7 @@ def build_package_docker(
         build_args = [
             'docker', 'build',
             '--pull',
+            '--network=host',
             '-f', str(central_dockerfile),
             '--build-arg', f'BASE_IMAGE={base_image}',
             '--build-arg', f'PACKAGE_NAME={package_name}',
@@ -726,6 +802,7 @@ def build_package_docker(
         # Step 2: Create and start container
         create_args = [
             'docker', 'create',
+            '--network=host',
             '--name', container_name,
             image_name
         ]
@@ -777,6 +854,302 @@ def build_package_docker(
         return False
 
 
+def build_package_native(
+    package_dir: Path,
+    package_name: str,
+    package_version: str,
+    package_release: str,
+    dist_dir: Path,
+    repository: str,
+    dry_run: bool = False
+) -> bool:
+    """
+    Build a package natively without Docker, running build scripts directly.
+
+    Args:
+        package_dir: Directory containing the package resources
+        package_name: Name of the package
+        package_version: Package version
+        package_release: Package release number
+        dist_dir: Directory to store built packages
+        repository: Repository path (e.g., 'almalinux/el9')
+        dry_run: If True, only show what would be done
+
+    Returns:
+        True if build succeeded, False otherwise
+    """
+    logger = logging.getLogger(__name__)
+
+    try:
+        # Ensure dist directory exists with repository structure
+        package_dist_dir = dist_dir / repository
+        if not dry_run:
+            package_dist_dir.mkdir(parents=True, exist_ok=True)
+
+        # Create a temporary workspace for native build
+        import tempfile
+        with tempfile.TemporaryDirectory() as temp_dir:
+            temp_path = Path(temp_dir)
+            app_dir = temp_path / "app"
+            app_dist_dir = app_dir / "dist"
+
+            # Create directories
+            if not dry_run:
+                app_dir.mkdir(parents=True, exist_ok=True)
+                app_dist_dir.mkdir(parents=True, exist_ok=True)
+
+            # Copy package resources to temp directory
+            import shutil
+            temp_resources_dir = app_dir / "resources"
+            if not dry_run:
+                shutil.copytree(package_dir / "resources", temp_resources_dir)
+
+            # Read metadata.yaml to get all package fields
+            metadata_file = package_dir / "metadata.yaml"
+            metadata = {}
+            if metadata_file.exists():
+                try:
+                    with open(metadata_file, 'r') as f:
+                        metadata = yaml.safe_load(f) or {}
+                except Exception as e:
+                    logger.warning(f"Could not read metadata.yaml: {e}")
+
+            logger.info(f"Building RPM for {package_name} version {package_version} natively")
+
+            if dry_run:
+                logger.info(f"[DRY RUN] Would build natively from: {temp_path}")
+                logger.info("[DRY RUN] Would set environment variables:")
+                logger.info(f"[DRY RUN]   PACKAGE_NAME={package_name}")
+                logger.info(f"[DRY RUN]   PACKAGE_VERSION={package_version}")
+                logger.info(f"[DRY RUN]   PACKAGE_RELEASE={package_release}")
+                logger.info(f"[DRY RUN]   PACKAGE_DESCRIPTION={metadata.get('description', '')}")
+                logger.info(f"[DRY RUN] Would run: {temp_resources_dir / 'build.sh'}")
+                logger.info(f"[DRY RUN] Would copy artifacts to: {package_dist_dir}")
+                return True
+
+            # Set up environment variables like the Dockerfile does
+            build_env = os.environ.copy()
+            build_env.update({
+                'PACKAGE_NAME': package_name,
+                'PACKAGE_VERSION': package_version,
+                'PACKAGE_RELEASE': package_release,
+                'PACKAGE_DESCRIPTION': metadata.get('description', ''),
+                'PACKAGE_MAINTAINER': metadata.get('maintainer', ''),
+                'PACKAGE_HOMEPAGE': metadata.get('homepage', ''),
+                'PACKAGE_LICENSE': metadata.get('license', ''),
+                'PACKAGE_ARCH': metadata.get('arch', 'amd64'),
+                'PACKAGE_PLATFORM': metadata.get('platform', 'linux')
+            })
+
+            # Run the build script
+            build_script = temp_resources_dir / "build.sh"
+            if not build_script.exists():
+                logger.error(f"Build script not found: {build_script}")
+                return False
+
+            # Make build script executable
+            build_script.chmod(0o755)
+
+            logger.debug(f"Running build script: {build_script}")
+            result = subprocess.run(
+                [str(build_script)],
+                cwd=app_dir,
+                env=build_env,
+                capture_output=True,
+                text=True
+            )
+
+            if result.returncode != 0:
+                logger.error(f"Native build failed for {package_name}")
+                logger.error(f"stdout: {result.stdout}")
+                logger.error(f"stderr: {result.stderr}")
+                return False
+
+            # Copy artifacts to final destination
+            if app_dist_dir.exists():
+                for item in app_dist_dir.iterdir():
+                    if item.is_file():
+                        shutil.copy2(item, package_dist_dir)
+
+            logger.info(f"Successfully built {package_name}-{package_version}-{package_release} natively")
+            return True
+
+    except Exception as e:
+        logger.error(f"Unexpected error building {package_name} natively: {e}")
+        return False
+
+
+def build_package_buildah(
+    package_dir: Path,
+    package_name: str,
+    package_version: str,
+    package_release: str,
+    dist_dir: Path,
+    repository: str,
+    base_image: str = "git.unkin.net/unkin/almalinux9-rpmbuilder:latest",
+    dry_run: bool = False
+) -> bool:
+    """
+    Build a package using Buildah without Docker daemon.
+
+    Args:
+        package_dir: Directory containing the package resources
+        package_name: Name of the package
+        package_version: Package version
+        package_release: Package release number
+        dist_dir: Directory to store built packages
+        repository: Repository path (e.g., 'almalinux/el9')
+        base_image: Base Docker image to use for building
+        dry_run: If True, only show what would be done
+
+    Returns:
+        True if build succeeded, False otherwise
+    """
+    logger = logging.getLogger(__name__)
+
+    try:
+        # Ensure dist directory exists with repository structure
+        package_dist_dir = dist_dir / repository
+        if not dry_run:
+            package_dist_dir.mkdir(parents=True, exist_ok=True)
+
+        # Generate container name
+        container_name = f"{package_name}-{package_version}-buildah"
+
+        # Read metadata.yaml to get all package fields
+        metadata_file = package_dir / "metadata.yaml"
+        metadata = {}
+        if metadata_file.exists():
+            try:
+                with open(metadata_file, 'r') as f:
+                    metadata = yaml.safe_load(f) or {}
+            except Exception as e:
+                logger.warning(f"Could not read metadata.yaml: {e}")
+
+        logger.info(f"Building RPM for {package_name} version {package_version} using Buildah")
+
+        if dry_run:
+            logger.info(f"[DRY RUN] Would use Buildah to build from: {base_image}")
+            logger.info("[DRY RUN] Would set environment variables:")
+            logger.info(f"[DRY RUN]   PACKAGE_NAME={package_name}")
+            logger.info(f"[DRY RUN]   PACKAGE_VERSION={package_version}")
+            logger.info(f"[DRY RUN]   PACKAGE_RELEASE={package_release}")
+            logger.info(f"[DRY RUN] Would copy artifacts to: {package_dist_dir}")
+            return True
+
+        try:
+            # Step 1: Create a working container from base image
+            from_args = ['buildah', 'from', '--name', container_name, base_image]
+            logger.debug(f"Running: {' '.join(from_args)}")
+            result = subprocess.run(from_args, capture_output=True, text=True)
+
+            if result.returncode != 0:
+                logger.error(f"Failed to create Buildah container from {base_image}")
+                logger.error(f"stderr: {result.stderr}")
+                return False
+
+            # Step 2: Set environment variables
+            env_vars = {
+                'PACKAGE_NAME': package_name,
+                'PACKAGE_VERSION': package_version,
+                'PACKAGE_RELEASE': package_release,
+                'PACKAGE_DESCRIPTION': metadata.get('description', ''),
+                'PACKAGE_MAINTAINER': metadata.get('maintainer', ''),
+                'PACKAGE_HOMEPAGE': metadata.get('homepage', ''),
+                'PACKAGE_LICENSE': metadata.get('license', ''),
+                'PACKAGE_ARCH': metadata.get('arch', 'amd64'),
+                'PACKAGE_PLATFORM': metadata.get('platform', 'linux')
+            }
+
+            for key, value in env_vars.items():
+                config_args = ['buildah', 'config', '--env', f'{key}={value}', container_name]
+                logger.debug(f"Running: {' '.join(config_args)}")
+                result = subprocess.run(config_args, capture_output=True, text=True)
+                if result.returncode != 0:
+                    logger.error(f"Failed to set environment variable {key}")
+                    return False
+
+            # Step 3: Copy resources to container
+            copy_args = [
+                'buildah', 'copy', container_name,
+                str(package_dir / "resources"), '/app/resources'
+            ]
+            logger.debug(f"Running: {' '.join(copy_args)}")
+            result = subprocess.run(copy_args, capture_output=True, text=True)
+
+            if result.returncode != 0:
+                logger.error(f"Failed to copy resources to container")
+                logger.error(f"stderr: {result.stderr}")
+                return False
+
+            # Step 4: Create dist directory in container
+            run_args = ['buildah', 'run', container_name, 'mkdir', '-p', '/app/dist']
+            logger.debug(f"Running: {' '.join(run_args)}")
+            result = subprocess.run(run_args, capture_output=True, text=True)
+
+            # Step 5: Run the build script
+            run_args = ['buildah', 'run', '--workingdir', '/app', container_name, '/app/resources/build.sh']
+            logger.debug(f"Running: {' '.join(run_args)}")
+            result = subprocess.run(run_args, capture_output=True, text=True)
+
+            if result.returncode != 0:
+                logger.error(f"Buildah build script failed for {package_name}")
+                logger.error(f"stdout: {result.stdout}")
+                logger.error(f"stderr: {result.stderr}")
+                return False
+
+            # Step 6: Copy artifacts from container to host
+            copy_out_args = [
+                'buildah', 'run', container_name,
+                'find', '/app/dist', '-type', 'f', '-name', '*.rpm'
+            ]
+            result = subprocess.run(copy_out_args, capture_output=True, text=True)
+            logger.debug(f"Find RPMs result: {result.stdout}")
+
+            if result.returncode == 0 and result.stdout.strip():
+                rpm_files = result.stdout.strip().split('\n')
+                logger.info(f"Found {len(rpm_files)} RPM files to copy")
+
+                for rpm_file in rpm_files:
+                    rpm_file = rpm_file.strip()
+                    if rpm_file:
+                        # Use buildah mount to copy files out
+                        mount_args = ['buildah', 'mount', container_name]
+                        mount_result = subprocess.run(mount_args, capture_output=True, text=True)
+
+                        if mount_result.returncode == 0:
+                            container_path = mount_result.stdout.strip()
+                            source_file = Path(container_path) / rpm_file.lstrip('/')
+
+                            if source_file.exists():
+                                import shutil
+                                dest_file = package_dist_dir / source_file.name
+                                shutil.copy2(source_file, dest_file)
+                                logger.debug(f"Copied {source_file} to {dest_file}")
+                            else:
+                                logger.error(f"Source file not found: {source_file}")
+
+                            # Unmount
+                            subprocess.run(['buildah', 'unmount', container_name], capture_output=True)
+                        else:
+                            logger.error(f"Failed to mount container: {mount_result.stderr}")
+            else:
+                logger.warning(f"No RPM files found or find command failed: {result.stderr}")
+
+            logger.info(f"Successfully built {package_name}-{package_version}-{package_release} using Buildah")
+            return True
+
+        finally:
+            # Step 7: Clean up container
+            rm_args = ['buildah', 'rm', container_name]
+            logger.debug(f"Running: {' '.join(rm_args)}")
+            subprocess.run(rm_args, capture_output=True, text=True)
+
+    except Exception as e:
+        logger.error(f"Unexpected error building {package_name} with Buildah: {e}")
+        return False
+
+
 def cleanup_images(image_pattern: str = "*-builder") -> None:
     """
     Clean up Docker images matching a pattern.
@@ -917,7 +1290,9 @@ class Builder:
         release: str,
         dry_run: bool = False,
         force: bool = False,
-        distro: str = 'almalinux/el9'
+        distro: str = 'almalinux/el9',
+        native: bool = False,
+        buildah: bool = False
     ) -> bool:
         """
         Build a single package.
@@ -993,9 +1368,9 @@ class Builder:
             return False
 
         package_info = PackageInfo(package, version, release, package_dir, distro, base_image)
-        return self._build_package(package_info, dry_run, force)
+        return self._build_package(package_info, dry_run, force, native, buildah)
 
-    def build_all(self, dry_run: bool = False, force: bool = False, parallel: int = 4, distro: str = 'el/9') -> bool:
+    def build_all(self, dry_run: bool = False, force: bool = False, parallel: int = 4, distro: str = 'el/9', native: bool = False, buildah: bool = False) -> bool:
         """
         Build all packages.
 
@@ -1017,29 +1392,29 @@ class Builder:
         self.logger.info(f"Found {len(packages)} packages to process")
 
         if parallel == 1:
-            return self._build_sequential(packages, dry_run, force)
+            return self._build_sequential(packages, dry_run, force, native, buildah)
         else:
-            return self._build_parallel(packages, dry_run, force, parallel)
+            return self._build_parallel(packages, dry_run, force, parallel, native, buildah)
 
-    def _build_sequential(self, packages: List[PackageInfo], dry_run: bool, force: bool) -> bool:
+    def _build_sequential(self, packages: List[PackageInfo], dry_run: bool, force: bool, native: bool, buildah: bool) -> bool:
         """Build packages sequentially."""
         success_count = 0
 
         for package_info in packages:
-            if self._build_package(package_info, dry_run, force):
+            if self._build_package(package_info, dry_run, force, native, buildah):
                 success_count += 1
 
         self.logger.info(f"Built {success_count}/{len(packages)} packages successfully")
         return success_count == len(packages)
 
-    def _build_parallel(self, packages: List[PackageInfo], dry_run: bool, force: bool, parallel: int) -> bool:
+    def _build_parallel(self, packages: List[PackageInfo], dry_run: bool, force: bool, parallel: int, native: bool, buildah: bool) -> bool:
         """Build packages in parallel."""
         success_count = 0
 
         with ThreadPoolExecutor(max_workers=parallel) as executor:
             # Submit all build tasks
             future_to_package = {
-                executor.submit(self._build_package, pkg, dry_run, force): pkg
+                executor.submit(self._build_package, pkg, dry_run, force, native, buildah): pkg
                 for pkg in packages
             }
 
@@ -1056,7 +1431,7 @@ class Builder:
         self.logger.info(f"Built {success_count}/{len(packages)} packages successfully")
         return success_count == len(packages)
 
-    def _build_package(self, package_info: PackageInfo, dry_run: bool, force: bool) -> bool:
+    def _build_package(self, package_info: PackageInfo, dry_run: bool, force: bool, native: bool = False, buildah: bool = False) -> bool:
         """
         Build a single package.
 
@@ -1081,22 +1456,55 @@ class Builder:
                     )
                     return True
 
-            # Check Docker is available (unless dry run)
+            # Check build tool availability (unless dry run)
-            if not dry_run and not check_docker_available():
+            use_native = native
-                self.logger.error("Docker is not available or running")
+            use_buildah = buildah
+            use_docker = not use_native and not use_buildah and check_docker_available()
+            if not use_native and not use_buildah and not use_docker:
+                use_buildah = check_buildah_available()
+            if not use_native and not use_buildah and not use_docker:
+                use_native = check_native_build_deps()
+
+            if not dry_run and not use_native and not use_buildah and not use_docker:
+                self.logger.error("No build tools available (tried native, Buildah, Docker)")
                 return False
 
-            # Build the package
+            # Build the package using available tool
-            return build_package_docker(
+            if use_native:
-                package_dir=package_info.directory,
+                self.logger.debug(f"Using native build for {package_info.name}")
-                package_name=package_info.name,
+                return build_package_native(
-                package_version=package_info.version,
+                    package_dir=package_info.directory,
-                package_release=package_info.release,
+                    package_name=package_info.name,
-                dist_dir=self.dist_dir,
+                    package_version=package_info.version,
-                repository=package_info.distro,
+                    package_release=package_info.release,
-                base_image=package_info.base_image,
+                    dist_dir=self.dist_dir,
-                dry_run=dry_run
+                    repository=package_info.distro,
-            )
+                    dry_run=dry_run
+                )
+            elif use_buildah:
+                self.logger.debug(f"Using Buildah to build {package_info.name}")
+                return build_package_buildah(
+                    package_dir=package_info.directory,
+                    package_name=package_info.name,
+                    package_version=package_info.version,
+                    package_release=package_info.release,
+                    dist_dir=self.dist_dir,
+                    repository=package_info.distro,
+                    base_image=package_info.base_image,
+                    dry_run=dry_run
+                )
+            else:
+                self.logger.debug(f"Using Docker to build {package_info.name}")
+                return build_package_docker(
+                    package_dir=package_info.directory,
+                    package_name=package_info.name,
+                    package_version=package_info.version,
+                    package_release=package_info.release,
+                    dist_dir=self.dist_dir,
+                    repository=package_info.distro,
+                    base_image=package_info.base_image,
+                    dry_run=dry_run
+                )
 
         except Exception as e:
             self.logger.error(f"Failed to build {package_info}: {e}")
@@ -1358,6 +1766,8 @@ def build(
     distro: str = typer.Option("almalinux/el9", help="Target distro (default: almalinux/el9)"),
     dry_run: bool = typer.Option(False, "--dry-run", help="Show what would be built without building"),
     force: bool = typer.Option(False, "--force", help="Build even if package exists in registry"),
+    native: bool = typer.Option(False, "--native", help="Force native build (skip Docker even if available)"),
+    buildah: bool = typer.Option(False, "--buildah", help="Force Buildah build (requires Buildah)"),
     verbose: bool = typer.Option(False, "--verbose", "-v", help="Enable verbose logging")
 ):
     """Build a specific package."""
@@ -1419,7 +1829,9 @@ def build(
             release=str(release),
             dry_run=dry_run,
             force=force,
-            distro=distro
+            distro=distro,
+            native=native,
+            buildah=buildah
         )
 
         if not success:
@@ -1435,6 +1847,8 @@ def build_all(
     force: bool = typer.Option(False, "--force", help="Build even if packages exist in registry"),
     parallel: int = typer.Option(4, help="Number of parallel builds"),
     distro: str = typer.Option("almalinux/el9", help="Target distro (almalinux/el8, almalinux/el9, or 'all' for all distros)"),
+    native: bool = typer.Option(False, "--native", help="Force native build (skip Docker even if available)"),
+    buildah: bool = typer.Option(False, "--buildah", help="Force Buildah build (requires Buildah)"),
     verbose: bool = typer.Option(False, "--verbose", "-v", help="Enable verbose logging")
 ):
     """Build all packages."""
@@ -1448,7 +1862,9 @@ def build_all(
             dry_run=dry_run,
             force=force,
             parallel=parallel,
-            distro=distro
+            distro=distro,
+            native=native,
+            buildah=buildah
         )
 
         if not success:

tools/update-gh

@@ -154,6 +154,33 @@ def load_env_vars(env_file: Path) -> Dict[str, str]:
     return env_vars
 
 
+def get_claude_ai_latest_version() -> Optional[str]:
+    """
+    Get the latest claude-code version from downloads.claude.ai.
+
+    Returns:
+        Latest version string or None if not found
+    """
+    logger = logging.getLogger(__name__)
+
+    try:
+        url = "https://downloads.claude.ai/claude-code-releases/latest"
+        logger.debug(f"Checking claude-code latest version: {url}")
+        response = requests.get(url, timeout=30)
+
+        if response.status_code == 200:
+            version = response.text.strip()
+            logger.debug(f"Latest claude-code version: {version}")
+            return version
+        else:
+            logger.warning(f"Unexpected response from claude.ai: {response.status_code}")
+            return None
+
+    except requests.RequestException as e:
+        logger.error(f"Failed to check claude-code version: {e}")
+        return None
+
+
 def get_github_latest_release(repo: str) -> Optional[Dict]:
     """
     Get the latest release from GitHub API.
@@ -315,26 +342,30 @@ def check_package_updates(package_dir: Path, dry_run: bool = False) -> bool:
         package_name = metadata.get('name', package_dir.name)
         current_version = metadata.get('version')
         github_repo = metadata.get('github')
+        claude_ai = metadata.get('claude_ai', False)
 
-        if not github_repo:
+        if not github_repo and not claude_ai:
-            logger.debug(f"Package {package_name} has no GitHub repo configured")
+            logger.debug(f"Package {package_name} has no GitHub repo or claude_ai configured")
             return True
 
         if not current_version:
             logger.warning(f"Package {package_name} has no version in metadata")
             return False
 
-        logger.info(f"Checking {package_name} (current: {current_version}) from {github_repo}")
+        if claude_ai:
-
+            logger.info(f"Checking {package_name} (current: {current_version}) from downloads.claude.ai")
-        # Get latest release from GitHub
+            latest_version = get_claude_ai_latest_version()
-        latest_release = get_github_latest_release(github_repo)
+            if not latest_version:
-        if not latest_release:
+                return False
-            return False
+        else:
-
+            logger.info(f"Checking {package_name} (current: {current_version}) from {github_repo}")
-        latest_version = normalize_version(latest_release.get('tag_name', ''))
+            latest_release = get_github_latest_release(github_repo)
-        if not latest_version:
+            if not latest_release:
-            logger.warning(f"Could not determine latest version for {package_name}")
+                return False
-            return False
+            latest_version = normalize_version(latest_release.get('tag_name', ''))
+            if not latest_version:
+                logger.warning(f"Could not determine latest version for {package_name}")
+                return False
 
         # Compare versions
         if compare_versions(current_version, latest_version):
@@ -373,7 +404,7 @@ def find_packages_with_github(rpms_dir: Path) -> List[Path]:
             with open(metadata_file, 'r') as f:
                 metadata = yaml.safe_load(f)
 
-            if metadata.get('github'):
+            if metadata.get('github') or metadata.get('claude_ai'):
                 github_packages.append(package_dir)
         except Exception:
             continue