From de2b8acf8a518385943ddcb438634d7f31dae6d8 Mon Sep 17 00:00:00 2001 From: unkin-agent Date: Mon, 14 Sep 2026 23:30:11 +1000 Subject: [PATCH 1/2] Add puppet-vault-signers repository Host the Go rewrites of the certmanager and sshsignhost Vault signing helpers. - Add config/git.unkin.net/unkin/repository/puppet-vault-signers.yaml - Protect main with Owners-only merge and the standard woodpecker checks --- .../unkin/repository/puppet-vault-signers.yaml | 14 ++++++++++++++ 1 file changed, 14 insertions(+) create mode 100644 config/git.unkin.net/unkin/repository/puppet-vault-signers.yaml diff --git a/config/git.unkin.net/unkin/repository/puppet-vault-signers.yaml b/config/git.unkin.net/unkin/repository/puppet-vault-signers.yaml new file mode 100644 index 0000000..c5f76e3 --- /dev/null +++ b/config/git.unkin.net/unkin/repository/puppet-vault-signers.yaml @@ -0,0 +1,14 @@ +description: "Go replacements for the certmanager and sshsignhost Vault signing helpers" +private: false +default_branch: "main" +default_delete_branch_after_merge: true +default_merge_style: "squash" +branch_protection: + - rule_name: "main" + merge_whitelist_teams: + - "Owners" + enable_push: false + status_check_contexts: + - "ci/woodpecker/pr/build" + - "ci/woodpecker/pr/test" + - "ci/woodpecker/pr/pre-commit" -- 2.47.3 From 1a43ed6a472343a78a9fd1776d6c998f37cc7fdd Mon Sep 17 00:00:00 2001 From: unkin-agent Date: Sat, 19 Sep 2026 10:21:14 +1000 Subject: [PATCH 2/2] repository: add sshsignhost and scope certmanager to X.509 Puppet calls /usr/local/bin/certmanager and /usr/local/bin/sshsignhost at hardcoded paths, so each tool needs a repo named for its binary. --- config/git.unkin.net/unkin/repository/certmanager.yaml | 2 +- .../repository/{puppet-vault-signers.yaml => sshsignhost.yaml} | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) rename config/git.unkin.net/unkin/repository/{puppet-vault-signers.yaml => sshsignhost.yaml} (79%) diff --git a/config/git.unkin.net/unkin/repository/certmanager.yaml b/config/git.unkin.net/unkin/repository/certmanager.yaml index ace6955..1a7e733 100644 --- a/config/git.unkin.net/unkin/repository/certmanager.yaml +++ b/config/git.unkin.net/unkin/repository/certmanager.yaml @@ -1,4 +1,4 @@ -description: "Vault PKI certificate issuance and SSH host key signing tool for Puppet-managed infrastructure" +description: "Vault-backed X.509 certificate signing helper for Puppet" private: false default_branch: "master" default_delete_branch_after_merge: true diff --git a/config/git.unkin.net/unkin/repository/puppet-vault-signers.yaml b/config/git.unkin.net/unkin/repository/sshsignhost.yaml similarity index 79% rename from config/git.unkin.net/unkin/repository/puppet-vault-signers.yaml rename to config/git.unkin.net/unkin/repository/sshsignhost.yaml index c5f76e3..3c75956 100644 --- a/config/git.unkin.net/unkin/repository/puppet-vault-signers.yaml +++ b/config/git.unkin.net/unkin/repository/sshsignhost.yaml @@ -1,4 +1,4 @@ -description: "Go replacements for the certmanager and sshsignhost Vault signing helpers" +description: "Vault-backed SSH host certificate signing helper for Puppet" private: false default_branch: "main" default_delete_branch_after_merge: true -- 2.47.3