unkin-agent
67426b9e6e
Puppet's generate() splices stderr into stdout, so the Python helper's
error prints and its absent HTTP timeouts can corrupt a catalog compile or
hang it forever.
- sign SSH host certificates via Vault approle or kubernetes auth
- emit only {"signed_key": ...} on stdout, errors on stderr, non-zero exit
- forward valid_principals to Vault unsplit; bound every call by a timeout
- keep TLS verification skippable via tls_skip_verify (default true)
- package the binary and completions as an RPM; add PR and tag pipelines
41 lines
1.0 KiB
YAML
41 lines
1.0 KiB
YAML
---
|
|
# nfpm config for building the sshsignhost RPM.
|
|
# Rendered through envsubst (see scripts/build-rpm.sh) then fed to `nfpm pkg`.
|
|
|
|
name: ${PACKAGE_NAME}
|
|
version: ${PACKAGE_VERSION}
|
|
release: ${PACKAGE_RELEASE}
|
|
arch: ${PACKAGE_ARCH}
|
|
platform: ${PACKAGE_PLATFORM}
|
|
section: default
|
|
priority: extra
|
|
description: "${PACKAGE_DESCRIPTION}"
|
|
|
|
maintainer: ${PACKAGE_MAINTAINER}
|
|
homepage: ${PACKAGE_HOMEPAGE}
|
|
license: ${PACKAGE_LICENSE}
|
|
|
|
disable_globbing: false
|
|
|
|
contents:
|
|
# Puppet's generate() calls the binary at this exact path.
|
|
- src: dist/sshsignhost
|
|
dst: /usr/local/bin/sshsignhost
|
|
file_info:
|
|
mode: 0755
|
|
owner: root
|
|
group: root
|
|
|
|
- src: dist/completions/sshsignhost.bash
|
|
dst: /usr/share/bash-completion/completions/sshsignhost
|
|
file_info:
|
|
mode: 0644
|
|
- src: dist/completions/_sshsignhost
|
|
dst: /usr/share/zsh/site-functions/_sshsignhost
|
|
file_info:
|
|
mode: 0644
|
|
- src: dist/completions/sshsignhost.fish
|
|
dst: /usr/share/fish/vendor_completions.d/sshsignhost.fish
|
|
file_info:
|
|
mode: 0644
|