Orienteering

Step-by-step how-tos. Pick up the map and follow along.

Embed the trust anchor in your binary and require signature verification on update, without bricking anyone already running an old build.

Mint an OpenPGP public key from a KMS-held private key you cannot hold, and publish it somewhere the release platform cannot reach.

Let CI sign with a KMS key without storing any AWS credentials, using OIDC federation. Covers both the GitLab and the GitHub path.

Stand up a production signing key in AWS KMS with Terraform, so the private half is generated inside KMS and can never be exported.

The laptop-only quick start: make a signing key, mint the public key you publish, sign a file, and verify it with both gtb and plain gpg.

Whoever controls your release page can swap a binary, and a checksum hosted beside it proves nothing. A seven-part guide to signing releases.

Generating a Go command from a shell script or a plain sentence, and the repair agent that has to make the result build before you see it.

Add OpenTelemetry traces, metrics and logs to a Go service with middleware and manual spans, and get one end-to-end trace through the gateway.

Generate an OpenAPI v3 document from an annotated proto file and serve it from the same HTTPS server with an embedded Stoplight Elements UI.

Replace a hand-written REST layer with grpc-gateway: add google.api.http annotations, generate the gateway, and delete the duplicate encoding.