.goreleaser.yml

version: 2

# Verifiable build
gomod:
  # Proxy a module from proxy.golang.org, making the builds verifiable.
  # This will only be effective if running against a tag. Snapshots will ignore
  # this setting.
  # Notice: for this to work your `build.main` must be a package, not a `.go` file.
  proxy: true

  # If proxy is true, use these environment variables when running `go mod`
  # commands (namely, `go mod tidy`).
  #
  # Default: `os.Environ()` merged with what you set the root `env` section.
  env:
    - GOPROXY=https://proxy.golang.org,direct
    - GOSUMDB=sum.golang.org

  # Sets the `-mod` flag value.
  mod: mod

  # Directory in which the go.mod file is.
  #
  # Default: ''.
  dir: .

# Reproducible build
builds:
  - env:
      - CGO_ENABLED=0
    mod_timestamp: "{{ .CommitTimestamp }}"
    flags:
      - -trimpath
    ldflags:
      - -s -w -X main.version={{.Version}} -X main.commit={{.Commit}} -X main.date={{ .CommitDate }}

# Exract SBOM
sboms:
  - artifacts: archive
  - id: source
    artifacts: source

checksum:
  name_template: "CHECKSUMS"

# Releaser
nfpms:
  - vendor: Ajabep
    homepage: https://github.com/ajabep/unmtlsproxy
    maintainer: Ajabep <https://github.com/ajabep>
    description: |-
      Just a silly app to remove the mutual TLS authentication to some services.
      This is useful when a tool is not supporting mTLS.
      However, it should not being used in production!
    license: Apache 2.0
    formats:
      - apk
      - deb
      - rpm
      - termux.deb
      - archlinux

    bindir: /usr/bin

    version_metadata: git

# Signing!
signs:
  - id: checksum
    cmd: cosign
    certificate: "${artifact}.pem"
    args:
      - "sign-blob"
      - "--output-certificate=${certificate}"
      - "--output-signature=${signature}"
      - "${artifact}"
      - "--yes" # needed on cosign 2.0.0+
    artifacts: checksum