Blog
Reviewing a scaffolder turned up a command name that quietly conflated two different things. A flag and a setting are not the same object.
FFmpeg in pure Go with no install, no CGO and no disk: a WebAssembly build running over an in-memory filesystem, and why it exists.
An AI repair agent declared success the moment the code compiled. The linter disagreed, and the gap between those two is the whole story.
An audit found that a Cobra option had never been enabled, so the root command hooks had silently not run on any subcommand for months.
The philosophical end of the signing series: a stolen key and a bought one produce the same signature, and trust has to survive both.
Rotate a release signing key and recover from a bad one without locking users out. Why asymmetric KMS keys have no auto-rotate button.
Launching krites, a local-first wedding photo culler built for one photographer who had four thousand frames and a weekend to get through them.
Make a tagged release sign itself: record the KMS key and regenerate GoReleaser config with a signs block that calls gtb sign directly.
Embed the trust anchor in your binary and require signature verification on update, without bricking anyone already running an old build.
Mint an OpenPGP public key from a KMS-held private key you cannot hold, and publish it somewhere the release platform cannot reach.
rust-tool-base
Pioneering
afmpeg
First Light
go-tool-base
Ai
signing
Soapbox
Orienteering
krites
