go-tool-base

The underpinnings for any Go application that ships as a binary: command-line tools to start with, and (as more than half of what is built on it now proves) long-running services and local web UIs too. It standardises the boilerplate and wiring you end up writing in every Go project, and puts config, logging, self-update, a DI container and the rest straight at your fingertips. Highly opinionated, and it makes some calls people will disagree with, but it works, and it works really well. The CLI it ships with is a big part of that: keeping a Go app built, updated and maintained becomes almost trivial.

Rotate a release signing key and recover from a bad one without locking users out. Why asymmetric KMS keys have no auto-rotate button.

Make a tagged release sign itself: record the KMS key and regenerate GoReleaser config with a signs block that calls gtb sign directly.

Embed the trust anchor in your binary and require signature verification on update, without bricking anyone already running an old build.

Mint an OpenPGP public key from a KMS-held private key you cannot hold, and publish it somewhere the release platform cannot reach.

Let CI sign with a KMS key without storing any AWS credentials, using OIDC federation. Covers both the GitLab and the GitHub path.

Stand up a production signing key in AWS KMS with Terraform, so the private half is generated inside KMS and can never be exported.

A generated nested command would not compile, and the cause was a scaffolder handing every call the same key regardless of depth.

The laptop-only quick start: make a signing key, mint the public key you publish, sign a file, and verify it with both gtb and plain gpg.

Whoever controls your release page can swap a binary, and a checksum hosted beside it proves nothing. A seven-part guide to signing releases.

Building an AI dungeon master to test a Go chat client, and the bug that kept resurrecting a goblin the player had definitively killed.