Sign your own binaries with go-tool-base, part 3: keyless CI signing with OIDC
Let CI sign with a KMS key without storing any AWS credentials, using OIDC federation. Covers both the GitLab and the GitHub path.
Tags
3 pages
Github
Why go-tool-base left GitHub for GitLab
An accidental major version bump was the last straw after months of unreliability. Why a Go framework moved off GitHub, and what moved with it.
OpenSSF Scorecard graded my supply chain
Running OpenSSF Scorecard on a Go project flagged mutable action tags, over-broad workflow token permissions, and a missing maintenance signal.
