unkinben
71cc398197
Provide a transit-style Vault/OpenBao secrets engine whose key material is OpenPGP, so services can sign/verify/encrypt/decrypt with GPG keys that never leave the barrier — and so tools like pass can encrypt to an exported public key while delegating decryption back to Vault. - Add versioned key management (keys/<name> CRUD+list, config, rotate, import) with private material seal-wrapped under key/ and per-key locking. - Add sign/verify (detached OpenPGP) and encrypt/decrypt paths; decrypt auto-detects armored vs raw-binary ciphertext (what pass/gpg write). - Add export/<public-key|private-key>/<name>; public always exportable, private only when the key is marked exportable. - Use ProtonMail go-crypto for OpenPGP; support rsa-2048/3072/4096 and ed25519. - Clone the sibling plugin's build/packaging/CI: dual-target RPMs (vault + openbao plugin dirs), Woodpecker PR/release pipelines, and a Vault+OpenBao e2e harness. Unit tests include real gpg and pass interop.
48 lines
1.5 KiB
YAML
48 lines
1.5 KiB
YAML
when:
|
|
- event: tag
|
|
|
|
steps:
|
|
- name: build
|
|
image: git.unkin.net/unkin/almalinux9-gobuilder:20260606
|
|
commands:
|
|
- make build VERSION=${CI_COMMIT_TAG}
|
|
backend_options:
|
|
kubernetes:
|
|
serviceAccountName: default
|
|
resources:
|
|
requests: {memory: 512Mi, cpu: 1}
|
|
limits: {memory: 2Gi, cpu: 2}
|
|
|
|
- name: package
|
|
image: git.unkin.net/unkin/almalinux9-rpmbuilder:latest
|
|
commands:
|
|
- ./scripts/build-rpm.sh ${CI_COMMIT_TAG}
|
|
depends_on: [build]
|
|
backend_options:
|
|
kubernetes:
|
|
serviceAccountName: default
|
|
resources:
|
|
requests: {memory: 512Mi, cpu: 1}
|
|
limits: {memory: 2Gi, cpu: 2}
|
|
|
|
- name: upload
|
|
image: git.unkin.net/unkin/almalinux9-base:20260606
|
|
commands:
|
|
- |
|
|
HOST="https://artifactapi.k8s.syd1.au.unkin.net"
|
|
REPO="rpm-internal"
|
|
for rpm in dist/*.rpm; do
|
|
FILE=$$(basename "$$rpm")
|
|
code=$$(curl -s -o /dev/null -w '%{http_code}' "$$HOST/api/v2/remotes/$$REPO/files/Packages/$$FILE" || true)
|
|
if [ "$$code" = "200" ]; then echo "$$FILE exists; skipping"; continue; fi
|
|
echo "Uploading $$FILE (probe $$code)"
|
|
curl -f -X PUT "$$HOST/api/v2/remotes/$$REPO/files/$$FILE" -H "Content-Type: application/x-rpm" --data-binary @"$$rpm"
|
|
done
|
|
depends_on: [package]
|
|
backend_options:
|
|
kubernetes:
|
|
serviceAccountName: default
|
|
resources:
|
|
requests: {memory: 128Mi, cpu: 100m}
|
|
limits: {memory: 512Mi, cpu: 500m}
|