CI images move off the packer-images monorepo to semver-released container-* repos.
- run RPM build steps on docker-internal/rpmbuilder:0.1.0-alma9
Reviewed-on: #3
Co-authored-by: unkin-agent <unkin-agent@unkin.net>
Co-committed-by: unkin-agent <unkin-agent@unkin.net>
Why: standardize Go CI on the estate gobuilder image and cut cold build/test
time with the shared S3 build cache.
- build/test/pre-commit/release(build) now use gobuilder:0.1.2-alma9
- add GOCACHE_* env + AWS creds (org secrets) to those steps
- cache dir is absolute (/tmp/gocache), metrics enabled
- bump k8s resource requests/limits for compile+cache overhead
- packaging/upload steps (nfpm, no Go) left untouched
Reviewed-on: #2
Co-authored-by: unkin-agent <unkin-agent@unkin.net>
Co-committed-by: unkin-agent <unkin-agent@unkin.net>
Provide a transit-style Vault/OpenBao secrets engine whose key material is
OpenPGP, so services can sign/verify/encrypt/decrypt with GPG keys that never
leave the barrier — and so tools like pass can encrypt to an exported public
key while delegating decryption back to Vault.
- Add versioned key management (keys/<name> CRUD+list, config, rotate, import)
with private material seal-wrapped under key/ and per-key locking.
- Add sign/verify (detached OpenPGP) and encrypt/decrypt paths; decrypt
auto-detects armored vs raw-binary ciphertext (what pass/gpg write).
- Add export/<public-key|private-key>/<name>; public always exportable,
private only when the key is marked exportable.
- Use ProtonMail go-crypto for OpenPGP; support rsa-2048/3072/4096 and ed25519.
- Clone the sibling plugin's build/packaging/CI: dual-target RPMs
(vault + openbao plugin dirs), Woodpecker PR/release pipelines, and a
Vault+OpenBao e2e harness. Unit tests include real gpg and pass interop.
unkin-agent
benvin
unkinben
gitadmin