go-tool-base

The underpinnings for any Go command-line tool, and (as a few of my projects now prove) for comprehensive web services too. It standardises the boilerplate and wiring you end up writing in every Go project, and puts config, logging, self-update, a DI container and the rest straight at your fingertips. Highly opinionated, and it makes some calls people will disagree with, but it works, and it works really well. The CLI it ships with is a big part of that: keeping a Go app built, updated and maintained becomes almost trivial.

An AI repair agent declared success the moment the code compiled. The linter disagreed, and the gap between those two is the whole story.

An audit found that a Cobra option had never been enabled, so the root command hooks had silently not run on any subcommand for months.

Rotate a release signing key and recover from a bad one without locking users out. Why asymmetric KMS keys have no auto-rotate button.

Make a tagged release sign itself: record the KMS key and regenerate GoReleaser config with a signs block that calls gtb sign directly.

Embed the trust anchor in your binary and require signature verification on update, without bricking anyone already running an old build.

Mint an OpenPGP public key from a KMS-held private key you cannot hold, and publish it somewhere the release platform cannot reach.

Let CI sign with a KMS key without storing any AWS credentials, using OIDC federation. Covers both the GitLab and the GitHub path.

Stand up a production signing key in AWS KMS with Terraform, so the private half is generated inside KMS and can never be exported.

A generated nested command would not compile, and the cause was a scaffolder handing every call the same key regardless of depth.

The laptop-only quick start: make a signing key, mint the public key you publish, sign a file, and verify it with both gtb and plain gpg.