sigillum
Sign and verify release artefacts from the command line, whatever your project is written in. The private key never leaves your KMS, HSM or PEM file.
Matt Cockayne · building in the open since 2012
Always leave the codebase better than you found it.
I'm Matt Cockayne. I build Go and Rust tooling, and the infrastructure that makes a release something you can prove came from you. Twenty years of it, most of it in the parts other people build on.
55 public projects
195 posts
Go · Rust · OpenTofu
one pair of hands
What I'd look at first
afmpeg
FFmpeg in pure Go. No CGO, no install on the box, no temp files: a WASM build over an in-memory filesystem.
go-tool-base
The framework the rest of the estate is extracted from. Config, errors, transport, observability and release plumbing that already agree with each other.
- signing The Go library sigillum is built on, for signing and verifying inside your own tool.
- config Layered configuration that can tell you where every value came from, and write a change back without wrecking the file.
- keryx Turns a written post into a narrated vertical reel, and publishes it.
- rust-tool-base The same ideas as go-tool-base, in a language that argues back.
If you only read five
Start here
Five posts that between them cover most of what this is: how the tooling works, what I think about the industry, and why any of it exists.
Latest
Or take a whole subject
9 guides
The blog runs newest-first, which is right for reading along and no use at all if you have turned up with a problem. Each of these is one subject, start to finish, in the order it makes sense.
Ask phpbotscout
He answers questions about the projects on the Discord, and he is better at it than I am after nine o'clock. Bring a bug, an idea, or a questionable engineering decision.