Zero to Hero - shell-scripting

Snippet/Draft: systemd-networkd-wait-online.service Waits Too Long During Ubuntu Startup

2025-07-13T00:00:00+00:00

Quick fix: Disable the service (if you don’t need to wait for network at boot):</p>

sudo</span> systemctl disable systemd-networkd-wait-online.service</span></span></code></pre>
Better fixes:</p>
Configure it to wait only for specific interfaces:</p>
Edit the service:</p>
sudo</span> systemctl edit systemd-networkd-wait-online.service</span></span></code></pre>
Add:</p>
ini[Service]</span></span>
ExecStart=</span></span>
ExecStart=/lib/systemd/systemd-networkd-wait-online --interface=eth0</span></span></code></pre>
Reduce the timeout:</p>
[</span>Service</span>]</span></span>
ExecStart</span>=</span></span>
ExecStart</span>=</span>/lib/systemd/systemd-networkd-wait-online --</span>timeout</span>=</span>10</span></span></code></pre>
Check which interfaces are causing delays:</p>
hnetworkctl</span> status</span></span></code></pre>
Look for interfaces that are “configuring” or “pending”.</p>
If you’re using NetworkManager instead of systemd-networkd</code>, you can disable
this service and enable the NetworkManager equivalent:</p>
sudo</span> systemctl disable systemd-networkd-wait-online.service</span></span>
sudo</span> systemctl enable NetworkManager-wait-online.service</span></span></code></pre>
The most common cause is having network interfaces defined in /etc/netplan/</code> or
/etc/network/interfaces</code> that aren’t actually connected, causing the service
to wait for them unnecessarily.</p>



Bulk Import Bookmarks to Shiori: A Simple Bash Script Solution
2025-06-22T00:00:00+00:00
If you’re like me and have accumulated hundreds of bookmarks across various
services, migrating them to a self-hosted solution like
Shiori</strong></a> can feel daunting. While
Shiori</strong>’s simplicity is one of its strengths, importing bookmarks one by one
through the web UI or CLI can be time-consuming.</p>
In this post, I’ll share a bash script that automates the bulk import process,
making it easy to migrate your entire bookmark collection to Shiori</strong> in
minutes and finally break free from the “social” bookmarking ecosystem.</p>
What is Shiori?</h2>
Shiori</a> is a simple, self-hosted bookmark
manager written in Go</a>. I like to call it my
“antisocial bookmark manager</em>” because it’s the complete opposite of modern,
social-media-influenced bookmarking services. There are no social features,
no “trending” sections, no algorithmic recommendations, and definitely
no tracking.</p>
It’s just you and your bookmarks, exactly how it should be.</p>
Think of Shiori as your personal library: A quiet, private space where you can
save and organize content that matters to you, without the noise and
distractions of the modern web.</p>
Why I Chose Shiori Over Traditional Services</h2>
After years of using various “as a service</em>” bookmark managers
(Pocket, Instapaper, Pinboard, and others), I made the switch to Shiori</strong>.</p>
Here is “why” in a nutshell:</p>
Complete Privacy and Control</h3>
Your bookmarks reveal a lot about your interests, research, and thought
processes. With Shiori being self-hosted, your data never leaves your server,
or your laptop, if you prefer to host your bookmarks locally.</p>
No company is analyzing your reading habits, selling your data, or using it to
train AI models.</p>
True Offline Access</h3>
Shiori doesn’t just save links - it creates full offline archives of web pages.</p>
This means:</p>

Content remains accessible even if the original site goes down</li>
No more “404 Page Not Found” disappointments</li>
Read your saved articles without an internet connection
*Protection against content changes or removals</li>
</ul>
No Vendor Lock-in</h3>
With traditional services, you’re at the mercy of:</p>

Pricing changes (remember when Pocket introduced Pocket Premium?</em>)</li>
Feature removals (RIP Google Reader</em>)</li>
Service shutdowns (Delicious, anyone?</em>)</li>
API restrictions and rate limits</li>
</ul>
With Shiori</strong>, you own your data and the software. It’s open source, so even
if development stops, your bookmarks remain accessible.</p>
Clean, Distraction-Free Interface</h3>
Unlike modern services that push “recommended content” or “what’s trending,”
Shiori</strong> presents only what you’ve saved. No algorithmic feed, no social
features trying to increase engagement—just a clean, searchable list of
your bookmarks.</p>
Lightweight and Fast</h3>
Running on a simple SQLite database (or, PostgreSQL/MySQL, if you prefer</em>),
Shiori</strong> is incredibly lightweight. It runs comfortably on a
Raspberry Pi, doesn’t require complex infrastructure, and starts up in seconds.</p>
Developer-Friendly</h3>
With a proper CLI interface and straightforward database schema, Shiori</strong>
plays well with scripts and automation. You can easily:</p>

Bulk import/export bookmarks</li>
Integrate with other tools</li>
Create custom workflows</li>
Automate bookmark management</li>
</ul>
The Migration Challenge</h2>
Shiori provides several ways to add bookmarks:</p>

Through the web interface (one at a time</em>)</li>
Using the CLI command shiori add <url></code> (also one at a time</em>)</li>
Importing from browsers (limited format support</em>)</li>
</ul>
But what if you have a simple text file with hundreds of URLs? Or what if
you’re migrating from another service that exports to a basic list format?</p>
That’s where automation comes in handy.</p>
The Solution: A Bulk Import Script</h2>
I’ve created a bash script that:</p>

Reads URLs from a text file (one URL per line</em>)</li>
Adds each bookmark to Shiori automatically</li>
Tracks success/failure statistics</li>
Logs errors for troubleshooting</li>
Provides progress feedback during import</li>
</ul>
Here’s the complete script:</p>
#!/bin/bash</span></span>
</span>
# Script to bulk import links to Shiori</span></span>
# Usage: ./import.sh <links_file.txt></span></span>
</span>
LINKS_FILE</span>=</span>"</span>./links.txt</span>"</span></span>
if</span> [</span> $#</span> -eq</span> 0</span> ]</span>;</span> then</span></span>
  echo</span> "</span>Usage: </span>$0</span> <links_file.txt></span>"</span></span>
  echo</span> "</span>Defaulting to ./links.txt</span>"</span></span>
else</span> </span></span>
  LINKS_FILE</span>=</span>"</span>$1</span>"</span></span>
fi</span></span>
</span>
# Check if the file exists</span></span>
if</span> [</span> ! -f</span> "</span>$LINKS_FILE</span>"</span> ]</span>;</span> then</span></span>
  echo</span> "</span>Error: File '</span>$LINKS_FILE</span>' not found!</span>"</span></span>
  exit</span> 1</span></span>
fi</span></span>
</span>
# Check if shiori is in PATH</span></span>
if</span> !</span> command</span> -v</span> shiori</span> &</span>></span> /dev/null</span>;</span> then</span></span>
  echo</span> "</span>Error: shiori command not found in PATH!</span>"</span></span>
  echo</span> "</span>Please ensure shiori binary is accessible</span>"</span></span>
  exit</span> 1</span></span>
fi</span></span>
</span>
# Counter variables</span></span>
total</span>=</span>0</span></span>
success</span>=</span>0</span></span>
failed</span>=</span>0</span></span>
</span>
# Log file for errors</span></span>
ERROR_LOG</span>=</span>"</span>shiori_import_errors_</span>$(</span>date</span> +%Y%m%d_%H%M%S</span>)</span>.log</span>"</span></span>
</span>
echo</span> "</span>Starting Shiori import from: </span>$LINKS_FILE</span>"</span></span>
echo</span> "</span>Errors will be logged to: </span>$ERROR_LOG</span>"</span></span>
echo</span> "</span>----------------------------------------</span>"</span></span>
</span>
# Read the file line by line</span></span>
while</span> IFS</span>=</span> read</span> -r</span> url</span> ||</span> [</span> -n</span> "</span>$url</span>"</span> ]</span>;</span> do</span></span>
  # Skip empty lines and lines starting with #</span></span>
  if</span> [[</span> -z</span> "</span>$url</span>"</span> ]]</span> ||</span> [[</span> "</span>$url</span>"</span> =~</span> ^</span>[[</span>:space:</span>]]</span>*</span># </span>]]</span>;</span> then</span></span>
    continue</span></span>
  fi</span></span>
</span>
  # Trim whitespace</span></span>
  url</span>=</span>$(</span>echo</span> "</span>$url</span>"</span> |</span> xargs</span>)</span></span>
</span>
  ((</span>total</span>++</span>))</span></span>
  echo</span> -n</span> "</span>[</span>$total</span>] Adding: </span>$url</span> ... </span>"</span></span>
</span>
  # Add bookmark to Shiori</span></span>
  if</span> output</span>=</span>$(</span>shiori</span> add</span> "</span>$url</span>"</span> 2>&1</span>);</span> then</span></span>
    echo</span> "</span>SUCCESS</span>"</span></span>
    ((</span>success</span>++</span>))</span></span>
</span>
    # Extract bookmark ID from output (macOS compatible)</span></span>
    bookmark_id</span>=</span>$(</span>echo</span> "</span>$output</span>"</span> |</span> \</span></span>
      grep</span> -o</span> '</span>ID:[[:space:]]*[0-9]*</span>'</span> |</span> grep</span> -o</span> '</span>[0-9]*</span>'</span> ||</span> \</span></span>
      echo</span> "</span>$output</span>"</span> |</span> grep</span> -o</span> '</span>Added bookmark with ID [0-9]*</span>'</span> |</span> \</span></span>
      grep</span> -o</span> '</span>[0-9]*$</span>'</span> ||</span> \</span></span>
      echo</span> "</span>$output</span>"</span> |</span> grep</span> -o</span> '</span>[0-9]\+</span>'</span> |</span> head</span> -1</span>)</span></span>
</span>
    if</span> [</span> -n</span> "</span>$bookmark_id</span>"</span> ]</span>;</span> then</span></span>
      echo</span> "</span>   → Bookmark ID: </span>$bookmark_id</span>"</span></span>
    fi</span></span>
  else</span></span>
    echo</span> "</span>FAILED</span>"</span></span>
    ((</span>failed</span>++</span>))</span></span>
</span>
    echo</span> "</span>[</span>$total</span>] Failed to add: </span>$url</span>"</span> >></span> "</span>$ERROR_LOG</span>"</span></span>
    echo</span> "</span>Error: </span>$output</span>"</span> >></span> "</span>$ERROR_LOG</span>"</span></span>
    echo</span> "</span>----------------------------------------</span>"</span> >></span> "</span>$ERROR_LOG</span>"</span></span>
  fi</span></span>
</span>
  # Small delay to avoid overwhelming the server</span></span>
  sleep</span> 0.5</span></span>
</span>
done</span> <</span> "</span>$LINKS_FILE</span>"</span></span>
</span>
echo</span> "</span>----------------------------------------</span>"</span></span>
echo</span> "</span>Import completed!</span>"</span></span>
echo</span> "</span>Total processed: </span>$total</span>"</span></span>
echo</span> "</span>Successful: </span>$success</span>"</span></span>
echo</span> "</span>Failed: </span>$failed</span>"</span></span>
</span>
if</span> [</span> $failed</span> -gt</span> 0</span> ]</span>;</span> then</span></span>
  echo</span> ""</span></span>
  echo</span> "</span>Check </span>$ERROR_LOG</span> for details on failed imports</span>"</span></span>
fi</span></span></code></pre>How to Use the Script</h2>
1. Prerequisites</h3>

Shiori</strong> installed and accessible in your $PATH</code>.</li>
A text file containing URLs (one per line</em>).</li>
Bash shell (works on Linux, macOS, and WSL</em>)</li>
</ul>
2. Prepare Your URL List</h3>
Create a file called links.txt</code> with your bookmarks:</p>
https://github.com/go-shiori/shiori</span></span>
https://news.ycombinator.com/</span></span>
https://example.com/article</span></span>
# This is a comment - it will be skipped</span></span>
https://another-site.com/</span></span>
</span>
# Empty lines are also skipped</span></span>
https://final-url.com/</span></span></code></pre>3. Run the Script</h3>
Save the script as import.sh</code>, make it executable, and run:</p>
chmod</span> +x import.sh</span></span>
./import.sh</span> links.txt</span></span></code></pre>
Or use the default links.txt</code> file:</p>
./import.sh</span></span></code></pre>4. Monitor Progress</h3>
The script provides real-time feedback:</p>
Starting Shiori import from: ./links.txt</span></span>
Errors will be logged to: shiori_import_errors_20250622_184441.log</span></span>
----------------------------------------</span></span>
[1] Adding: https://github.com/go-shiori/shiori ... SUCCESS</span></span>
   → Bookmark ID: 1</span></span>
[2] Adding: https://news.ycombinator.com/ ... SUCCESS</span></span>
   → Bookmark ID: 2</span></span>
[3] Adding: https://invalid-url ... FAILED</span></span>
----------------------------------------</span></span>
Import completed!</span></span>
Total processed: 3</span></span>
Successful: 2</span></span>
Failed: 1</span></span>
</span>
Check shiori_import_errors_20250622_184441.log \</span></span>
  for details on failed imports</span></span></code></pre>Key Features</h2>
Error Handling</h3>
The script creates a timestamped log file for any failures, making it easy to
identify and retry problematic URLs.</p>
Progress Tracking</h3>
Real-time feedback shows exactly which URLs are being processed and their
import status.</p>
Comment Support</h3>
Lines starting with #</code> are treated as comments and skipped, allowing you to
annotate your URL list.</p>
Rate Limiting</h3>
A 0.5-second delay between imports prevents overwhelming your Shiori instance.</p>
Cross-Platform Compatibility</h3>
The script uses POSIX-compliant commands and works on Linux, macOS,
and Windows (via WSL</em>).</p>
Extending the Script</h2>
Adding Tags</h3>
To add tags during import, modify the shiori command:</p>
shiori</span> add</span> "</span>$url</span>"</span> -t</span> "</span>imported,to-read</span>"</span> 2>&1</span></span></code></pre>Creating Offline Archives</h3>
Depending on your Shiori version, you might be able to create offline 4
archives during import. Check available options with:</p>
shiori</span> add</span> --help</span></span>
shiori</span> update</span> --help</span></span></code></pre>Parallel Processing</h3>
For faster imports with large lists, you could modify the script to use
GNU parallel:</p>
cat</span> links.txt</span> |</span> parallel</span> -j 4</span> shiori add {}</span></span></code></pre>Troubleshooting</h2>
Command Not Found</h3>
If you get “shiori: command not found”, ensure Shiori is in your $PATH</code>:</p>
which</span> shiori</span></span>
# Should output something like: /usr/local/bin/shiori</span></span></code></pre>Permission Denied</h3>
Make sure the script is executable:</p>
chmod</span> +x import.sh</span></span></code></pre>Special Characters in URLs</h3>
The script handles most URLs correctly, but if you have URLs with special
characters, ensure they’re properly encoded.</p>
Conclusion</h2>
This simple bash script has saved me hours of manual work when migrating
bookmarks to Shiori. It’s a great example of how a little automation can
streamline repetitive tasks.</p>
The script is intentionally kept simple and focused on the core functionality.
Feel free to modify it for your specific needs - perhaps adding custom titles,
excerpts, or integrating with other tools in your workflow.</p>
Happy bookmarking 🔖.</p>


Establishing SPIFFE Federation Between Kubernetes Clusters
2024-12-16T00:00:00+00:00
SPIFFE (Secure Production Identity Framework For Everyone) provides a robust framework for service identity across distributed systems. When using SPIFFE with SPIRE (SPIFFE Runtime Environment) in Kubernetes clusters, it’s common to have multiple trust domains. To enable secure communication between these domains, you need to establish SPIFFE federation by exchanging and trusting each other’s trust bundles.</p>
In this blog post, we’ll walk through the steps to establish SPIFFE federation between two Kubernetes clusters with separate trust domains.</p>
Scenario Overview</h2>
Assume you have:</p>

Server A with a trust domain trustdomainA</code></li>
Server B with a trust domain trustdomainB</code></li>
</ul>
Both servers are running SPIRE to manage identities. To enable federation, the servers need to exchange and trust each other’s trust bundles.</p>
Step 1: Export the Trust Bundle</h2>
Each SPIRE server has its own trust bundle, which includes the root CA certificate for its trust domain. Start by exporting the trust bundle from Server B:</p>
spire-server</span> bundle show</span> -format</span> spiffe</span></span></code></pre>
This command will output the trust bundle for trustdomainB</code> in SPIFFE format. Save this output to a file (e.g., trust-bundleB.pem</code>).</p>
Step 2: Configure Federation in Server A</h2>
Next, configure Server A to trust trustdomainB</code>. To do this, you’ll use the exported trust bundle from Server B.</p>
Add the trust bundle to Server A’s configuration:</p>
spire-server</span> bundle set</span> -format</span> spiffe</span> -id</span> spiffe://trustdomainB</span> -path</span> /path/to/trust-bundleB.pem</span></span></code></pre>
This command tells Server A to trust the root CA from trustdomainB</code>. Update Server A’s spire-server.conf</code> file if needed to reflect the federation relationship with trustdomainB</code>.</p>
Step 3: Validate the Trust Relationship</h2>
After configuration, Server A will validate any SPIFFE identity (SVID) from trustdomainB</code> by checking its signature against the root CA in the trust bundle.</p>
When Server A encounters an identity from trustdomainB</code>:</p>

It verifies the SVID’s signature</li>
If the signature is valid and matches the root CA from trustdomainB</code>, the identity is trusted</li>
</ul>
Step 4: Establish Bi-Directional Trust (Optional)</h2>
If you want Server B to trust identities from trustdomainA</code>, repeat the process in reverse:</p>

Export the trust bundle from Server A:</li>
</ol>
spire-server</span> bundle show</span> -format</span> spiffe</span></span></code></pre>

Configure Server B to trust the exported bundle by adding it to trustdomainA</code>:</li>
</ol>
spire-server</span> bundle set</span> -format</span> spiffe</span> -id</span> spiffe://trustdomainA</span> -path</span> /path/to/trust-bundleA.pem</span></span></code></pre>
Now, both servers trust each other’s identities, enabling mutual federation.</p>
Key Considerations</h2>
Bundle Rotation</h3>
If the root CA in a trust domain is rotated, the updated trust bundle must be shared with the other server to maintain trust.</p>
Unique SPIFFE IDs</h3>
Ensure that SPIFFE IDs are unique across trust domains to avoid collisions.</p>
Secure Transport</h3>
Always exchange trust bundles securely to prevent tampering.</p>
Conclusion</h2>
By following these steps, you can establish SPIFFE federation between two Kubernetes clusters with distinct trust domains. This enables secure identity-based communication across distributed systems, a critical component for modern cloud-native applications.</p>
SPIFFE federation simplifies the management of service identity across multiple clusters and trust domains, allowing you to focus on building secure and scalable applications.</p>


Understanding Docker's 6MB Memory Limit: A Deep Dive
2024-12-12T00:00:00+00:00
Have you ever encountered this puzzling error message while working with Docker containers?</p>
Warning Failed 89s (x12 over 3m44s) kubelet Error: Error response from daemon: Minimum memory limit allowed is 6MB</span></span></code></pre>
If you’re like many developers, your first instinct might be to check Kubernetes’ LimitRange resources:</p>
$</span> kubectl get limitrange</span> -A</span></span>
No</span> resources found</span></span></code></pre>
But wait - if there are no LimitRange resources defined, where is this 6MB limit coming from? Let’s dive deep into this common containerization puzzle.</p>
The Mystery of the 6MB Limit</h2>
The key to understanding this issue lies in recognizing that this limit isn’t coming from Kubernetes at all - it’s actually a built-in restriction in Docker itself. This often surprises developers because it’s not documented prominently in Docker’s documentation.</p>
Why Does This Limit Exist?</h3>
The 6MB minimum memory limit serves as a critical safeguard in Docker’s architecture. It’s designed to prevent containers from being started with dangerously low memory limits that could lead to:</p>

Immediate Out-of-Memory (OOM) kills</li>
Unstable container behavior</li>
System resource exhaustion</li>
Cascading failures in container orchestration</li>
</ul>
Configuration Options: What Can You Do?</h2>
While this limit is hardcoded into Docker’s engine, you’re not entirely without options. Here are several approaches to dealing with this limitation:</p>
1. Adjust Your Resource Allocation</h3>
The most straightforward solution is to ensure your containers have adequate memory allocation. If you’re hitting this limit, it’s worth questioning whether running with such minimal memory is truly optimal for your application.</p>
2. Alternative Approaches</h3>
If you absolutely need to work with very low memory limits, consider these options:</p>

Use Docker Swarm with Compatibility Mode</strong>: Running Docker Swarm with the --compatibility</code> flag can alter how memory limits are interpreted</li>
Switch Container Runtimes</strong>: Consider using containerd or another container runtime that doesn’t impose this limitation</li>
Custom Docker Build</strong>: Though not recommended for production, you could technically modify Docker’s source code to adjust this limit</li>
</ul>
Best Practices and Recommendations</h2>
When working with container memory limits, consider these best practices:</p>

Right-size Your Containers</strong>: Instead of trying to run with minimal memory, focus on appropriate sizing based on actual application needs</li>
Monitor Memory Usage</strong>: Use tools like cAdvisor or Prometheus to understand your actual memory usage patterns</li>
Test Thoroughly</strong>: Always test your containers under load to ensure memory limits are appropriate</li>
Document Your Settings</strong>: Make memory requirements and limits explicit in your deployment documentation</li>
</ol>
Conclusion</h2>
While Docker’s 6MB memory limit might seem restrictive at first, it’s actually a thoughtful safeguard that helps prevent potentially problematic container configurations. Understanding this limit - and working with it rather than against it - will help you build more reliable containerized applications.</p>
Remember: Just because you can run a container with minimal memory doesn’t always mean you should. Focus on stability and reliability over minimal resource usage unless you have a compelling reason to do otherwise.</p>
Additional Resources</h3>

Docker Documentation on Resource Constraints</li>
Kubernetes Memory Management Documentation</li>
Container Runtime Comparisons</li>
Memory Optimization Strategies for Containers</li>
</ul>
Happy containerizing!</p>


Installing VMware vCenter Server Appliance (vCSA): Stage 1 Deployment Guide
2024-12-12T00:00:00+00:00
This guide walks through the first stage of deploying vCenter Server Appliance (vCSA) on an ESXi host. Like any critical infrastructure deployment, proper preparation and verification at each step is essential for success.</p>
Prerequisites Verification</h2>
Before beginning the installation:</p>


Verify DNS resolution for target ESXi host:</p>
nslookup</span> esxi-4.zerotohero.dev</span></span>
# Should resolve to 192.168.1.104</span></span></code></pre></li>

Verify DNS resolution for vCSA FQDN:</p>
nslookup</span> vcsa.zerotohero.dev</span></span>
# Should resolve to 192.168.1.111</span></span></code></pre></li>
</ol>
Installation Process</h2>
1. Launch Installer</h3>

Navigate to mounted vCSA ISO</li>
Go to /vcsa-ui-installer/Win32/</code> directory</li>
Double-click installer executable</li>
</ul>
2. Initial Setup</h3>

Select “Install” from the main menu</li>
Acknowledge two-stage installation process</li>
Accept End User License Agreement (EULA)</li>
</ol>
3. Target Host Configuration</h3>

ESXi Host: esxi-4.zerotohero.dev</li>
Username: root</li>
Password: (lab password)</li>
Security Tip</strong>: Verify host SSL thumbprint matches ESXi DCUI (F2 > View Support Information)</li>
</ul>
4. vCSA VM Configuration</h3>

VM Name: vCSA</li>
Root Password: (set secure password)</li>
Deployment Size: Tiny (suitable for managing up to 10 hosts)</li>
Storage Size: Default</li>
</ul>
5. Storage Configuration</h3>

Select datastore: esxi-4</li>
Enable thin disk mode for efficient storage utilization</li>
Note: vSAN configuration (if needed) comes later</li>
</ul>
6. Network Configuration</h3>
Network Selection</h4>

Select “VM Network” port group</li>
Connects to vSwitch0 on management network</li>
Verify network connectivity via ESXi host client:

Navigate to Networking > Virtual Switches</li>
Confirm vSwitch0 configuration with VM Network port group</li>
Verify physical uplink (vmnic0) connectivity</li>
</ul>
</li>
</ul>
Network Settings</h4>

FQDN: vcsa.zerotohero.dev</li>
IP Address: 192.168.1.111</li>
Subnet Mask: 255.255.255.0</li>
Gateway: 192.168.1.1</li>
DNS Server: 192.168.1.100</li>
Default Ports:

HTTP: 80</li>
HTTPS: 443</li>
</ul>
</li>
</ul>
Important Notes</h2>
DNS Configuration</h3>

Proper DNS setup is critical for vCSA deployment</li>
Both forward and reverse DNS resolution must work correctly</li>
DNS issues are a common source of deployment problems</li>
</ul>
Network Connectivity</h3>

vCSA requires reliable network connectivity</li>
Management network access is essential</li>
Verify all network settings before proceeding</li>
</ul>
Time Synchronization</h3>

Accurate time settings are crucial</li>
NTP configuration follows in Stage 2</li>
</ul>
Next Steps</h2>
After Stage 1 completes (approximately 3-8 minutes):</p>

Verify VM deployment on ESXi host</li>
Proceed to Stage 2 configuration</li>
Configure SSO domain</li>
Set up initial vSphere environment</li>
</ol>
Remember: This is just Stage 1 of the deployment. Stage 2 will handle the configuration of the appliance, including SSO setup, time synchronization, and initial vSphere environment configuration.</p>


How to Export Kubernetes Secrets as JSON: A Complete Guide
2024-12-12T00:00:00+00:00
When working with Kubernetes secrets, you may need to export them in a format that can be version controlled or transferred between clusters. This guide will show you how to export Kubernetes secrets as JSON while preserving important metadata like labels and annotations.</p>
The Basic Approach</h2>
The fundamental command to export a secret in JSON format is straightforward:</p>
kubectl</span> get secret</span> <</span>secret-nam</span>e</span>></span> -o</span> json</span></span></code></pre>
However, this raw output includes cluster-specific information that you typically don’t want to include when exporting secrets for reuse. Let’s look at how to clean this up.</p>
Cleaning Up Cluster-Specific Information</h2>
To create a clean export that removes cluster-specific metadata, we can use jq</code> to process the JSON output. Here’s the recommended approach:</p>
kubectl</span> get secret</span> <</span>secret-nam</span>e</span>></span> -o</span> json</span> |</span> \</span></span>
jq</span> '</span>del(.metadata.creationTimestamp,.metadata.resourceVersion,.metadata.selfLink,.metadata.uid,.metadata.namespace,.metadata.ownerReferences)</span>'</span></span></code></pre>
This command removes the following fields:</p>

creationTimestamp</code>: When the secret was created in the source cluster</li>
resourceVersion</code>: The internal version number used by Kubernetes</li>
selfLink</code>: The API URL for this resource</li>
uid</code>: The unique identifier in the source cluster</li>
namespace</code>: The namespace in the source cluster</li>
ownerReferences</code>: References to parent resources</li>
</ul>
Working with Multiple Secrets</h2>
If you need to export all secrets from a namespace, you can modify the command slightly:</p>
kubectl</span> get secrets</span> -o</span> json</span> |</span> \</span></span>
jq</span> '</span>.items[] | del(.metadata.creationTimestamp,.metadata.resourceVersion,.metadata.selfLink,.metadata.uid,.metadata.namespace,.metadata.ownerReferences)</span>'</span></span></code></pre>Example Output</h2>
Here’s what a cleaned export might look like:</p>
{</span></span>
  "</span>apiVersion</span>": "</span>v1</span>",</span></span>
  "</span>kind</span>": "</span>Secret</span>",</span></span>
  "</span>metadata</span>": {</span></span>
    "</span>labels</span>": {</span></span>
      "</span>app</span>": "</span>myapp</span>",</span></span>
      "</span>environment</span>": "</span>production</span>"</span></span>
    },</span></span>
    "</span>annotations</span>": {</span></span>
      "</span>kubernetes.io/description</span>": "</span>Application credentials</span>"</span></span>
    },</span></span>
    "</span>name</span>": "</span>mysecret</span>"</span></span>
  },</span></span>
  "</span>type</span>": "</span>Opaque</span>",</span></span>
  "</span>data</span>": {</span></span>
    "</span>username</span>": "</span>YWRtaW4=</span>",</span></span>
    "</span>password</span>": "</span>MWYyZDFlMmU2N2Rm</span>"</span></span>
  }</span></span>
}</span></span></code></pre>Best Practices</h2>
When working with exported secrets, keep these tips in mind:</p>

Always verify the exported secret contains all necessary metadata (labels and annotations) before using it in a new environment</li>
Consider using tools like SOPS</a> or sealed-secrets</a> for encrypting secrets before storing them in version control</li>
Document any environment-specific values that might need to be modified when importing the secret into a new cluster</li>
Use meaningful labels and annotations to make secrets self-documenting</li>
</ol>
Conclusion</h2>
Exporting Kubernetes secrets as JSON is a common task in cluster management and application deployment. By following this guide, you can ensure your exported secrets are clean, portable, and ready for use in other environments while maintaining important metadata like labels and annotations.</p>


Parsing JWT Claims in Go: A Practical Guide
2024-12-10T00:00:00+00:00
When working with JWTs in Go, you’ll often need to extract and validate claims from the payload section. Let’s walk through how to do this effectively using the popular github.com/golang-jwt/jwt</code> package.</p>
Basic JWT Structure</h2>
First, let’s understand what we’re parsing. A JWT consists of three parts:</p>

Header (algorithm and token type)</li>
Payload (claims)</li>
Signature</li>
</ol>
Setting Up Your Project</h2>
Start by installing the required package:</p>
go</span> get</span> -u</span> github.com/golang-jwt/jwt/v5</span></span></code></pre>Creating a Claims Structure</h2>
Let’s define a structure to hold our claims:</p>
type</span> CustomClaims</span> struct</span> {</span></span>
    Issuer</span>    string</span> `</span>json:"iss"</span>`</span></span>
    Subject</span>   string</span> `</span>json:"sub"</span>`</span></span>
    ExpiresAt</span> int64</span>  `</span>json:"exp"</span>`</span></span>
    NotBefore</span> int64</span>  `</span>json:"nbf"</span>`</span></span>
    IssuedAt</span>  int64</span>  `</span>json:"iat"</span>`</span></span>
    jwt</span>.</span>RegisteredClaims</span></span>
}</span></span></code></pre>Parsing the Token</h2>
Here’s a complete example showing how to parse a JWT and extract its claims:</p>
package</span> main</span></span>
</span>
import</span> (</span></span>
    "</span>fmt</span>"</span></span>
    "</span>log</span>"</span></span>
    "</span>time</span>"</span></span>
</span>
    "</span>github.com/golang-jwt/jwt/v5</span>"</span></span>
)</span></span>
</span>
func</span> parseToken</span>(</span>tokenString</span> string</span>) (</span>*</span>CustomClaims</span>,</span> error</span>) {</span></span>
    // Parse the token</span></span>
    token</span>,</span> err</span> :=</span> jwt</span>.</span>ParseWithClaims</span>(</span>tokenString</span>,</span> &</span>CustomClaims</span>{},</span> func</span>(</span>token</span> *</span>jwt</span>.</span>Token</span>) (</span>interface</span>{},</span> error</span>) {</span></span>
        // Replace this with your actual secret key</span></span>
        return</span> []</span>byte</span>("</span>your-secret-key</span>"),</span> nil</span></span>
    })</span></span>
</span>
    if</span> err</span> !=</span> nil</span> {</span></span>
        return</span> nil</span>,</span> fmt</span>.</span>Errorf</span>("</span>error parsing token: </span>%v</span>",</span> err</span>)</span></span>
    }</span></span>
</span>
    // Type assert the claims</span></span>
    if</span> claims</span>,</span> ok</span> :=</span> token</span>.</span>Claims</span>.(</span>*</span>CustomClaims</span>);</span> ok</span> &&</span> token</span>.</span>Valid</span> {</span></span>
        return</span> claims</span>,</span> nil</span></span>
    }</span></span>
</span>
    return</span> nil</span>,</span> fmt</span>.</span>Errorf</span>("</span>invalid token claims</span>")</span></span>
}</span></span>
</span>
func</span> main</span>() {</span></span>
    // Example JWT string - replace with your actual token</span></span>
    tokenString</span> :=</span> "</span>your.jwt.token</span>"</span></span>
</span>
    claims</span>,</span> err</span> :=</span> parseToken</span>(</span>tokenString</span>)</span></span>
    if</span> err</span> !=</span> nil</span> {</span></span>
        log</span>.</span>Fatalf</span>("</span>Error: </span>%v</span>",</span> err</span>)</span></span>
    }</span></span>
</span>
    // Access the claims</span></span>
    fmt</span>.</span>Printf</span>("</span>Issuer: </span>%s\n</span>",</span> claims</span>.</span>Issuer</span>)</span></span>
    fmt</span>.</span>Printf</span>("</span>Subject: </span>%s\n</span>",</span> claims</span>.</span>Subject</span>)</span></span>
    fmt</span>.</span>Printf</span>("</span>Expires At: </span>%v\n</span>",</span> time</span>.</span>Unix</span>(</span>claims</span>.</span>ExpiresAt</span>,</span> 0</span>))</span></span>
    fmt</span>.</span>Printf</span>("</span>Not Before: </span>%v\n</span>",</span> time</span>.</span>Unix</span>(</span>claims</span>.</span>NotBefore</span>,</span> 0</span>))</span></span>
    fmt</span>.</span>Printf</span>("</span>Issued At: </span>%v\n</span>",</span> time</span>.</span>Unix</span>(</span>claims</span>.</span>IssuedAt</span>,</span> 0</span>))</span></span>
}</span></span></code></pre>Validation</h2>
The JWT library automatically validates:</p>

Token structure</li>
Signature</li>
Expiration time (exp)</li>
Not Before time (nbf)</li>
</ul>
However, you might want to add custom validation:</p>
func</span> validateClaims</span>(</span>claims</span> *</span>CustomClaims</span>)</span> error</span> {</span></span>
    // Example: Validate issuer</span></span>
    if</span> claims</span>.</span>Issuer</span> !=</span> "</span>spike-nexus</span>" {</span></span>
        return</span> fmt</span>.</span>Errorf</span>("</span>invalid issuer</span>")</span></span>
    }</span></span>
</span>
    // Example: Validate subject</span></span>
    if</span> claims</span>.</span>Subject</span> !=</span> "</span>spike-admin</span>" {</span></span>
        return</span> fmt</span>.</span>Errorf</span>("</span>invalid subject</span>")</span></span>
    }</span></span>
</span>
    return</span> nil</span></span>
}</span></span></code></pre>Error Handling</h2>
Here’s how to handle common JWT errors:</p>
func</span> handleJWTError</span>(</span>err</span> error</span>)</span> string</span> {</span></span>
    switch</span> {</span></span>
    case</span> errors</span>.</span>Is</span>(</span>err</span>,</span> jwt</span>.</span>ErrTokenMalformed</span>):</span></span>
        return</span> "</span>Token is malformed</span>"</span></span>
    case</span> errors</span>.</span>Is</span>(</span>err</span>,</span> jwt</span>.</span>ErrTokenExpired</span>):</span></span>
        return</span> "</span>Token has expired</span>"</span></span>
    case</span> errors</span>.</span>Is</span>(</span>err</span>,</span> jwt</span>.</span>ErrTokenNotValidYet</span>):</span></span>
        return</span> "</span>Token is not valid yet</span>"</span></span>
    default</span>:</span></span>
        return</span> "</span>Invalid token</span>"</span></span>
    }</span></span>
}</span></span></code></pre>Best Practices</h2>

Always validate the token signature using a secure key</li>
Check expiration and not-before claims</li>
Verify the issuer and subject claims match expected values</li>
Use proper error handling</li>
Consider using environment variables for sensitive values like secret keys</li>
</ol>
Testing</h2>
Here’s a simple test case:</p>
func</span> TestTokenParsing</span>(</span>t</span> *</span>testing</span>.</span>T</span>) {</span></span>
    tokenString</span> :=</span> "</span>your.test.token</span>"</span></span>
    claims</span>,</span> err</span> :=</span> parseToken</span>(</span>tokenString</span>)</span></span>
    </span></span>
    if</span> err</span> !=</span> nil</span> {</span></span>
        t</span>.</span>Errorf</span>("</span>Failed to parse token: </span>%v</span>",</span> err</span>)</span></span>
    }</span></span>
    </span></span>
    if</span> claims</span>.</span>Issuer</span> !=</span> "</span>spike-nexus</span>" {</span></span>
        t</span>.</span>Errorf</span>("</span>Expected issuer 'spike-nexus', got '</span>%s</span>'</span>",</span> claims</span>.</span>Issuer</span>)</span></span>
    }</span></span>
}</span></span></code></pre>Conclusion</h2>
Parsing JWT claims in Go is straightforward with the jwt-go</code> package. The key is to:</p>

Define a proper claims structure</li>
Use appropriate parsing methods</li>
Implement proper validation</li>
Handle errors gracefully</li>
</ul>
Remember to always validate tokens server-side and never trust client-provided tokens without verification.</p>


How to Decrypt Files Using age - A Quick Guide
2024-12-03T00:00:00+00:00
Age is a modern file encryption tool that’s simple yet powerful. Here’s how to decrypt age-encrypted files using a secret key.</p>
Prerequisites</h2>

age installed on your system</li>
An encrypted file (base64 encoded)</li>
A secret key (starting with AGE-SECRET-KEY-)</li>
</ul>
Step-by-Step Decryption</h2>

First, decode the base64 content to a file:</li>
</ol>
echo</span> "</span>YOUR-BASE64-CONTENT</span>"</span> |</span> base64</span> -d</span> ></span> encrypted.age</span></span></code></pre>

Save the secret key to a file:</li>
</ol>
echo</span> "</span>AGE-SECRET-KEY-YOUR-KEY</span>"</span> ></span> key.txt</span></span>
chmod</span> 600</span> key.txt</span>  # Set proper permissions</span></span></code></pre>

Decrypt the file:</li>
</ol>
age</span> --decrypt -i</span> key.txt encrypted.age</span></span></code></pre>Installing age</h2>
Choose your platform:</p>

macOS: brew install age</code></li>
Ubuntu/Debian: apt install age</code></li>
Other systems: Download from the age GitHub repository</a></li>
</ul>
Common Issues</h2>

Ensure you’re using only the AGE-SECRET-KEY line for decryption</li>
Verify the base64 content is complete and properly formatted</li>
Check file permissions on the key file (should be readable only by you)</li>
</ul>
Security Best Practices</h2>

Never share your secret key</li>
Delete key files after use</li>
Store encrypted files and keys separately</li>
Use secure channels when transferring encrypted files</li>
</ul>


Computing File Hashes in Unix Systems: A Complete Guide
2024-12-02T00:00:00+00:00
File hashing is an essential operation in software development, system administration, and security verification. This guide will walk you through the process of computing file hashes in Unix-like systems, with a focus on generating formatted SHA-256 hashes.</p>
Basic Hash Computation</h2>
The most straightforward way to compute a SHA-256 hash in Unix systems is using the sha256sum</code> command:</p>
sha256sum</span> filename</span></span></code></pre>
This produces output in the format:</p>
hash_value filename</span></span></code></pre>Formatted Hash Output</h2>
Sometimes you need to format the hash output in a specific way, particularly when working with systems that expect a certain structure. Here’s how to generate a hash in this format:</p>
type:"unix"  </span></span>
value:"sha256:HASH_VALUE"</span></span></code></pre>Command Construction</h3>
To achieve this format, we can combine several Unix commands:</p>
echo</span> "</span>type:</span>\"</span>unix</span>\"</span>  </span></span>
value:</span>\"</span>sha256:</span>$(</span>sha256sum</span> ./keeper</span> |</span> cut</span> -d</span>' '</span> -f1</span>)</span>\"</span>"</span></span></code></pre>
Let’s break down this command:</p>

sha256sum ./keeper</code>: Computes the SHA-256 hash of the file</li>
cut -d' ' -f1</code>: Extracts just the hash value, removing the filename</li>
Command substitution $()</code>: Embeds the hash into our formatted string</li>
echo</code>: Outputs the final formatted result</li>
</ol>
Use Cases</h3>
This formatting is particularly useful for:</p>

Configuration management systems</li>
Version control systems</li>
Security verification processes</li>
Automated build systems</li>
Documentation purposes</li>
</ul>
Alternative Hash Algorithms</h2>
While SHA-256 is commonly used, Unix systems support various other hashing algorithms:</p>

MD5 (using md5sum</code>)</li>
SHA-1 (using sha1sum</code>)</li>
SHA-224 (using sha224sum</code>)</li>
SHA-384 (using sha384sum</code>)</li>
SHA-512 (using sha512sum</code>)</li>
</ul>
Best Practices</h2>
When working with file hashes:</p>

Always verify the file path before computing the hash</li>
Use appropriate hash algorithms for your security requirements</li>
Consider using multiple hash algorithms for critical files</li>
Document the hashing process in your system documentation</li>
Implement verification steps in your deployment pipeline</li>
</ol>
Error Handling</h2>
When implementing hash computation in scripts, consider handling these common issues:</p>

File not found</li>
Insufficient permissions</li>
Corrupted files</li>
System command availability</li>
</ol>
Example error handling in a shell script:</p>
#!/bin/bash</span></span>
</span>
file</span>=</span>"</span>./keeper</span>"</span></span>
</span>
if</span> [</span> ! -f</span> "</span>$file</span>"</span> ]</span>;</span> then</span></span>
    echo</span> "</span>Error: File not found</span>"</span></span>
    exit</span> 1</span></span>
fi</span></span>
</span>
if</span> [</span> ! -r</span> "</span>$file</span>"</span> ]</span>;</span> then</span></span>
    echo</span> "</span>Error: Cannot read file (check permissions)</span>"</span></span>
    exit</span> 1</span></span>
fi</span></span>
</span>
hash_output</span>=</span>$(</span>sha256sum</span> "</span>$file</span>"</span> 2></span>/dev/null</span>)</span></span>
</span>
if</span> [</span> $?</span> -ne</span> 0</span> ]</span>;</span> then</span></span>
    echo</span> "</span>Error: Hash computation failed</span>"</span></span>
    exit</span> 1</span></span>
fi</span></span>
</span>
echo</span> "</span>type:</span>\"</span>unix</span>\"</span>  </span></span>
value:</span>\"</span>sha256:</span>$(</span>echo</span> "</span>$hash_output</span>"</span> |</span> cut</span> -d</span>' '</span> -f1</span>)</span>\"</span>"</span></span></code></pre>Conclusion</h2>
File hashing is a critical operation in many systems. By understanding how to compute and format hashes correctly, you can ensure your systems maintain security and integrity while meeting specific format requirements.</p>
Remember to always validate your hash computations and keep your hashing tools updated to maintain security standards.</p>


Securely Generating and Storing SPIRE Agent Tokens
2024-12-02T00:00:00+00:00
SPIRE (the SPIFFE Runtime Environment) requires tokens for agent authentication. Here’s a secure way to generate and store these tokens using bash scripting.</p>
The Problem</h2>
When working with SPIRE, we often need to generate agent tokens and store them for later use. The default spire-server token generate</code> command outputs tokens with a “Token: “ prefix, which isn’t always ideal for automation or direct use in configuration files.</p>
The Solution</h2>
Here’s a bash script that generates a SPIRE agent token, strips unnecessary prefixes, and stores it securely:</p>
#!/usr/bin/env bash</span></span>
</span>
#    \\ SPIKE: Keep your secrets secret with SPIFFE.</span></span>
#  \\\\\ Copyright 2024-present SPIKE contributors.</span></span>
# \\\\\\\ SPDX-License-Identifier: Apache-2.0</span></span>
</span>
TOKEN_FILE</span>=</span>"</span>agent-token.txt</span>"</span></span>
</span>
# Generate token and strip the "Token: " prefix</span></span>
if</span> !</span> spire-server</span> token generate</span> -spiffeID</span> spiffe://spike.ist/spire-agent</span> |</span> sed</span> '</span>s/^Token: //</span>'</span> ></span> "</span>$TOKEN_FILE</span>";</span> then</span></span>
    echo</span> "</span>Error: Failed to generate token</span>"</span> >&2</span></span>
    exit</span> 1</span></span>
fi</span></span>
</span>
# Verify file was created and is not empty</span></span>
if</span> [</span> ! -s</span> "</span>$TOKEN_FILE</span>"</span> ]</span>;</span> then</span></span>
    echo</span> "</span>Error: Token file is empty or was not created</span>"</span> >&2</span></span>
    exit</span> 1</span></span>
fi</span></span>
</span>
# Set restrictive permissions</span></span>
chmod</span> 600</span> "</span>$TOKEN_FILE</span>"</span></span>
</span>
echo</span> "</span>Token successfully generated and saved to </span>$TOKEN_FILE</span>"</span></span></code></pre>How It Works</h2>


Token Generation</strong>: The script uses spire-server token generate</code> to create a new token with a specific SPIFFE ID.</p>
</li>

Text Processing</strong>: A sed</code> command strips the “Token: “ prefix from the output:</p>

's/^Token: //'</code> replaces “Token: “ at the start of the line with nothing</li>
The clean token is then redirected to the output file</li>
</ul>
</li>

Error Handling</strong>:</p>

Checks if token generation succeeded</li>
Verifies the output file exists and isn’t empty</li>
Returns meaningful error messages</li>
</ul>
</li>

Security</strong>: Sets file permissions to 600 (read/write for owner only) to protect the token</p>
</li>
</ol>
Usage</h2>

Save the script as generate-agent-token.sh</code></li>
Make it executable: chmod +x generate-agent-token.sh</code></li>
Run it: ./generate-agent-token.sh</code></li>
</ol>
The token will be saved in agent-token.txt</code> in the current directory.</p>
Best Practices</h2>

Always use restrictive file permissions for token files</li>
Store tokens in a secure location</li>
Never commit tokens to version control</li>
Consider using environment variables or secure vaults for production environments</li>
</ul>
Conclusion</h2>
This script provides a secure and automated way to generate and store SPIRE agent tokens. By removing the prefix and implementing proper error handling, it makes token management more reliable and automation-friendly.</p>


Cross-Compiling Go Applications on M3 Macs: A Practical Guide
2024-11-27T00:00:00+00:00
Cross-compiling Go applications on Apple Silicon (M-series) Macs can be tricky, especially when dealing with CGO dependencies. In this guide, we’ll explore different approaches to building Go applications for multiple architectures, specifically targeting Linux (AMD64 and ARM64) and macOS (ARM64).</p>
The Challenge</h2>
When working with Go applications that use CGO, simple cross-compilation commands like GOOS=linux GOARCH=amd64 go build</code> might not be sufficient. This is particularly true when:</p>

Your application uses CGO-dependent packages</li>
You need to build for multiple architectures</li>
You’re working on an M-series Mac</li>
</ul>
Initial Approach: Local Cross-Compilation</h2>
My first attempt involved using traditional cross-compilation tools. Here’s what I initially tried:</p>
# Linux ARM64</span></span>
CGO_ENABLED</span>=</span>0</span> GOEXPERIMENT</span>=</span>boringcrypto</span> go</span> build</span> -o</span> keeper ./app/keeper/cmd/main.go</span></span>
CGO_ENABLED</span>=</span>1</span> GOEXPERIMENT</span>=</span>boringcrypto</span> go</span> build</span> -o</span> nexus ./app/nexus/cmd/main.go</span></span>
CGO_ENABLED</span>=</span>0</span> GOEXPERIMENT</span>=</span>boringcrypto</span> go</span> build</span> -o</span> spike ./app/spike/cmd/main.go</span></span></code></pre>
However, when trying to cross-compile for different architectures, I ran into issues:</p>
GOOS</span>=</span>linux</span> GOARCH</span>=</span>amd64</span> CGO_ENABLED</span>=</span>1</span> GOEXPERIMENT</span>=</span>boringcrypto</span> go</span> build</span> -o</span> nexus-linux-amd64 ./app/nexus/cmd/main.go</span></span></code></pre>
This approach failed because it needed proper cross-compilation toolchains.</p>
The Solution: Docker-Based Cross-Compilation</h2>
After exploring various options, I found that using Docker for cross-compilation provides the most reliable and reproducible solution. Here’s how to implement it:</p>

First, create a Dockerfile:</li>
</ol>
FROM</span> golang:1.21-alpine </span>AS</span> builder</span></span>
</span>
# Install build tools</span></span>
RUN</span> apk add --no-cache gcc musl-dev</span></span>
</span>
# Set working directory</span></span>
WORKDIR</span> /app</span></span>
</span>
# Copy go mod files</span></span>
COPY</span> go.mod go.sum ./</span></span>
RUN</span> go mod download</span></span>
</span>
# Copy source code</span></span>
COPY</span> . .</span></span>
</span>
# Build for different platforms</span></span>
RUN</span> GOOS=linux GOARCH=amd64 CGO_ENABLED=0 GOEXPERIMENT=boringcrypto go build -o keeper-linux-amd64 ./app/keeper/cmd/main.go && \</span></span>
    GOOS=linux GOARCH=amd64 CGO_ENABLED=1 GOEXPERIMENT=boringcrypto go build -o nexus-linux-amd64 ./app/nexus/cmd/main.go && \</span></span>
    GOOS=linux GOARCH=amd64 CGO_ENABLED=0 GOEXPERIMENT=boringcrypto go build -o spike-linux-amd64 ./app/spike/cmd/main.go && \</span></span>
    GOOS=linux GOARCH=arm64 CGO_ENABLED=0 GOEXPERIMENT=boringcrypto go build -o keeper-linux-arm64 ./app/keeper/cmd/main.go && \</span></span>
    GOOS=linux GOARCH=arm64 CGO_ENABLED=1 GOEXPERIMENT=boringcrypto go build -o nexus-linux-arm64 ./app/nexus/cmd/main.go && \</span></span>
    GOOS=linux GOARCH=arm64 CGO_ENABLED=0 GOEXPERIMENT=boringcrypto go build -o spike-linux-arm64 ./app/spike/cmd/main.go</span></span></code></pre>

Create a build script:</li>
</ol>
#!/bin/bash</span></span>
</span>
# Build the Docker image</span></span>
docker</span> build</span> -t</span> go-cross-compiler .</span></span>
</span>
# Create a container and copy the binaries</span></span>
docker</span> create</span> --name</span> temp-container go-cross-compiler</span></span>
docker</span> cp temp-container:/app/keeper-linux-amd64 .</span></span>
docker</span> cp temp-container:/app/nexus-linux-amd64 .</span></span>
docker</span> cp temp-container:/app/spike-linux-amd64 .</span></span>
docker</span> cp temp-container:/app/keeper-linux-arm64 .</span></span>
docker</span> cp temp-container:/app/nexus-linux-arm64 .</span></span>
docker</span> cp temp-container:/app/spike-linux-arm64 .</span></span>
</span>
# Clean up</span></span>
docker</span> rm temp-container</span></span></code></pre>Advantages of the Docker Approach</h2>

Reproducibility</strong>: The build environment is consistent across different development machines</li>
No Local Dependencies</strong>: No need to install cross-compilation tools locally</li>
Simplified Process</strong>: One command builds all targets</li>
Consistent Results</strong>: Binaries are built in a controlled environment</li>
Easy CI/CD Integration</strong>: The Docker-based approach works well in automated pipelines</li>
</ol>
Building for macOS ARM64</h2>
For macOS ARM64 builds, you can still build natively on your M-series Mac:</p>
GOOS</span>=</span>darwin</span> GOARCH</span>=</span>arm64</span> CGO_ENABLED</span>=</span>0</span> GOEXPERIMENT</span>=</span>boringcrypto</span> go</span> build</span> -o</span> keeper-darwin-arm64 ./app/keeper/cmd/main.go</span></span>
GOOS</span>=</span>darwin</span> GOARCH</span>=</span>arm64</span> CGO_ENABLED</span>=</span>1</span> GOEXPERIMENT</span>=</span>boringcrypto</span> go</span> build</span> -o</span> nexus-darwin-arm64 ./app/nexus/cmd/main.go</span></span>
GOOS</span>=</span>darwin</span> GOARCH</span>=</span>arm64</span> CGO_ENABLED</span>=</span>0</span> GOEXPERIMENT</span>=</span>boringcrypto</span> go</span> build</span> -o</span> spike-darwin-arm64 ./app/spike/cmd/main.go</span></span></code></pre>Common Pitfalls and Solutions</h2>

CGO Dependencies</strong>: When CGO_ENABLED=1</code>, ensure your Docker container has the necessary build tools installed</li>
Architecture Mismatch</strong>: Double-check GOOS</code> and GOARCH</code> values match your target platforms</li>
Build Tags</strong>: Consider using build tags for platform-specific code</li>
Static Linking</strong>: For better portability, use CGO_ENABLED=0</code> when possible</li>
</ol>
Conclusion</h2>
While cross-compilation on M-series Macs presents some challenges, using Docker provides a robust and maintainable solution. This approach simplifies the build process and ensures consistent results across different architectures.</p>
For projects that don’t require CGO, you might still use direct cross-compilation. However, for complex projects with CGO dependencies, the Docker-based approach is recommended.</p>
Remember to version your build scripts and Dockerfile alongside your project code to maintain build reproducibility across your team.</p>


Implementing Secure Password Input in Go CLI Applications
2024-11-27T00:00:00+00:00
When building command-line applications in Go, there often comes a time when you need to securely collect sensitive information from users, such as passwords. In this post, we’ll explore how to implement secure password input in a Go CLI application using best practices.</p>
The Challenge</h2>
Consider a typical CLI initialization command where you need to collect an admin password:</p>
func</span> NewInitCommand</span>(</span>source</span> *</span>workloadapi</span>.</span>X509Source</span>)</span> *</span>cobra</span>.</span>Command</span> {</span></span>
    var</span> initCmd</span> = &</span>cobra</span>.</span>Command</span>{</span></span>
        Use</span>:   "</span>init</span>",</span></span>
        Short</span>: "</span>Initialize spike configuration</span>",</span></span>
        Run</span>:</span> func</span>(</span>cmd</span> *</span>cobra</span>.</span>Command</span>,</span> args</span> []</span>string</span>) {</span></span>
            // How do we securely get the password?</span></span>
        },</span></span>
    }</span></span>
    return</span> initCmd</span></span>
}</span></span></code></pre>
Simply using fmt.Scanln()</code> or similar methods would display the password in plain text as the user types - a significant security risk. We need a better solution.</p>
The Solution: Using term.ReadPassword</h2>
Go’s golang.org/x/term</code> package provides a secure way to read passwords from the terminal. Here’s how to implement it:</p>

First, install the required dependency:</li>
</ol>
go</span> get golang.org/x/term</span></span></code></pre>

Import the necessary packages:</li>
</ol>
import</span> (</span></span>
    "</span>golang.org/x/term</span>"</span></span>
    "</span>syscall</span>"</span></span>
    "</span>fmt</span>"</span></span>
)</span></span></code></pre>

Implement the password collection:</li>
</ol>
func</span> NewInitCommand</span>(</span>source</span> *</span>workloadapi</span>.</span>X509Source</span>)</span> *</span>cobra</span>.</span>Command</span> {</span></span>
    var</span> initCmd</span> = &</span>cobra</span>.</span>Command</span>{</span></span>
        Use</span>:   "</span>init</span>",</span></span>
        Short</span>: "</span>Initialize spike configuration</span>",</span></span>
        Run</span>:</span> func</span>(</span>cmd</span> *</span>cobra</span>.</span>Command</span>,</span> args</span> []</span>string</span>) {</span></span>
            // Check initialization state</span></span>
            state</span>,</span> err</span> :=</span> net</span>.</span>CheckInitState</span>(</span>source</span>)</span></span>
            if</span> err</span> !=</span> nil</span> {</span></span>
                fmt</span>.</span>Println</span>("</span>Failed to check init state:</span>")</span></span>
                fmt</span>.</span>Println</span>(</span>err</span>.</span>Error</span>())</span></span>
                return</span></span>
            }</span></span>
</span>
            if</span> state</span> ==</span> data</span>.</span>AlreadyInitialized</span> {</span></span>
                fmt</span>.</span>Println</span>("</span>SPIKE is already initialized.</span>")</span></span>
                fmt</span>.</span>Println</span>("</span>Nothing to do.</span>")</span></span>
                return</span></span>
            }</span></span>
</span>
            // Collect password securely</span></span>
            fmt</span>.</span>Print</span>("</span>Enter admin password: </span>")</span></span>
            password</span>,</span> err</span> :=</span> term</span>.</span>ReadPassword</span>(</span>int</span>(</span>syscall</span>.</span>Stdin</span>))</span></span>
            if</span> err</span> !=</span> nil</span> {</span></span>
                fmt</span>.</span>Println</span>("</span>\n</span>Failed to read password:</span>")</span></span>
                fmt</span>.</span>Println</span>(</span>err</span>.</span>Error</span>())</span></span>
                return</span></span>
            }</span></span>
            fmt</span>.</span>Println</span>()</span> // Add newline after password input</span></span>
</span>
            // Convert to string if needed</span></span>
            passwordStr</span> :=</span> string</span>(</span>password</span>)</span></span>
</span>
            // Use the password...</span></span>
</span>
            fmt</span>.</span>Println</span>("")</span></span>
            fmt</span>.</span>Println</span>("</span>    SPIKE system initialization completed.</span>")</span></span>
            fmt</span>.</span>Println</span>("</span>      Generated admin token and saved it to</span>")</span></span>
            fmt</span>.</span>Println</span>("</span>        ./.spike-admin-token for future use.</span>")</span></span>
            fmt</span>.</span>Println</span>("")</span></span>
        },</span></span>
    }</span></span>
    return</span> initCmd</span></span>
}</span></span></code></pre>Why This Approach Works</h2>
This implementation offers several security benefits:</p>

Hidden Input</strong>: The password isn’t displayed on screen as the user types</li>
Memory Security</strong>: Password is initially stored as a byte slice ([]byte</code>), which can be securely wiped from memory</li>
Clean User Experience</strong>: The interface is professional and familiar to users</li>
Error Handling</strong>: Robust error handling for input failures</li>
Cross-Platform</strong>: Works across different operating systems</li>
</ol>
Best Practices</h2>
When implementing password input in your CLI applications:</p>

Clear Memory</strong>: If possible, clear the password from memory after use</li>
Validate Input</strong>: Add password strength requirements if needed</li>
Confirmation</strong>: For new passwords, consider asking users to type twice</li>
Clear Prompts</strong>: Use clear prompts to indicate what’s expected</li>
Error Messages</strong>: Provide helpful error messages without revealing sensitive information</li>
</ol>
Example: Adding Password Confirmation</h2>
For cases where users are setting a new password, here’s how to add confirmation:</p>
func</span> getPasswordWithConfirmation</span>() (</span>string</span>,</span> error</span>) {</span></span>
    fmt</span>.</span>Print</span>("</span>Enter new password: </span>")</span></span>
    password1</span>,</span> err</span> :=</span> term</span>.</span>ReadPassword</span>(</span>int</span>(</span>syscall</span>.</span>Stdin</span>))</span></span>
    if</span> err</span> !=</span> nil</span> {</span></span>
        return</span> "",</span> err</span></span>
    }</span></span>
    fmt</span>.</span>Println</span>()</span></span>
</span>
    fmt</span>.</span>Print</span>("</span>Confirm password: </span>")</span></span>
    password2</span>,</span> err</span> :=</span> term</span>.</span>ReadPassword</span>(</span>int</span>(</span>syscall</span>.</span>Stdin</span>))</span></span>
    if</span> err</span> !=</span> nil</span> {</span></span>
        return</span> "",</span> err</span></span>
    }</span></span>
    fmt</span>.</span>Println</span>()</span></span>
</span>
    if</span> string</span>(</span>password1</span>)</span> !=</span> string</span>(</span>password2</span>) {</span></span>
        return</span> "",</span> fmt</span>.</span>Errorf</span>("</span>passwords do not match</span>")</span></span>
    }</span></span>
</span>
    return</span> string</span>(</span>password1</span>),</span> nil</span></span>
}</span></span></code></pre>Conclusion</h2>
Implementing secure password input in Go CLI applications is straightforward with the right tools. The golang.org/x/term</code> package provides a robust solution that works across platforms and follows security best practices. By following these patterns, you can ensure your CLI applications handle sensitive information securely and professionally.</p>
Remember to always consider security implications when handling passwords and other sensitive data, and make sure to follow your organization’s security requirements and best practices.</p>


How to Count Lines in Your Source Code Projects: A Comprehensive Guide
2024-11-27T00:00:00+00:00
As software projects grow, tracking their size becomes increasingly important for maintenance, documentation, and planning. One fundamental metric is the line count of your source code. In this article, we’ll explore different methods to count lines in your codebase, from quick command-line solutions to more sophisticated tools.</p>
The Quick and Simple: Using wc</code></h2>
For Unix-like systems (Linux, macOS), the wc</code> (word count) command provides a straightforward way to count lines. Here’s how you can use it:</p>
# Count lines in a single file</span></span>
wc</span> -l</span> file.py</span></span></code></pre>
To count lines across multiple files, you can combine wc</code> with other Unix commands:</p>
# Count lines in all Python files in a directory</span></span>
find</span> .</span> -type</span> f</span> -name</span> "</span>*.py</span>"</span> |</span> xargs</span> wc</span> -l</span></span>
</span>
# Count lines recursively for all files</span></span>
find</span> .</span> -type</span> f</span> -exec</span> wc</span> -l</span> {}</span> \;</span></span></code></pre>
While wc</code> is fast and readily available, it’s rather basic - it counts all lines, including empty lines and comments.</p>
The Professional Solution: CLOC</h2>
CLOC (Count Lines of Code) is a specialized tool that provides detailed statistics about your codebase. It’s more intelligent than wc</code> as it can:</p>

Exclude blank lines and comments</li>
Recognize dozens of programming languages</li>
Provide detailed breakdowns by language</li>
Generate reports in various formats</li>
</ul>
Installing CLOC</h3>
# Ubuntu/Debian</span></span>
sudo</span> apt install cloc</span></span>
</span>
# macOS via Homebrew</span></span>
brew</span> install cloc</span></span>
</span>
# Windows via Chocolatey</span></span>
choco</span> install cloc</span></span></code></pre>Using CLOC</h3>
Basic usage is as simple as:</p>
cloc</span> .</span></span></code></pre>
This will scan your current directory and provide a detailed breakdown. For more specific analysis:</p>
# Count specific languages</span></span>
cloc</span> --include-lang=</span>"</span>Python,JavaScript</span>"</span> .</span></span>
</span>
# Generate XML report</span></span>
cloc</span> --xml --out=results.xml</span> .</span></span>
</span>
# Count lines in a Git repository</span></span>
git</span> clone</span> --depth 1</span> [repository-url]</span></span>
cloc</span> .</span></span></code></pre>Custom Python Solution</h2>
Sometimes you need more control over what and how you count. Here’s a Python script that you can customize for your specific needs:</p>
import</span> os</span></span>
from</span> pathlib</span> import</span> Path</span></span>
</span>
def</span> count_lines</span>(</span>directory</span>,</span> extensions</span>=</span>None</span>):</span></span>
    """</span></span>
    Count lines in files within a directory, optionally filtering by extension.</span></span>
    </span></span>
    Args:</span></span>
        directory (str): Path to the directory to scan</span></span>
        extensions (list): List of file extensions to include (e.g., ['.py', '.js'])</span></span>
    </span></span>
    Returns:</span></span>
        dict: Dictionary containing line counts and file statistics</span></span>
    """</span></span>
    stats</span> =</span> {</span></span>
        '</span>total_lines</span>':</span> 0</span>,</span></span>
        '</span>total_files</span>':</span> 0</span>,</span></span>
        '</span>files_by_extension</span>': {}</span></span>
    }</span></span>
    </span></span>
    for</span> path</span> in</span> Path</span>(</span>directory</span>).</span>rglob</span>('</span>*</span>'):</span></span>
        if</span> path</span>.</span>is_file</span>():</span></span>
            if</span> extensions</span> and not</span> any</span>(</span>str</span>(</span>path</span>).</span>endswith</span>(</span>ext</span>)</span> for</span> ext</span> in</span> extensions</span>):</span></span>
                continue</span></span>
                </span></span>
            ext</span> =</span> path</span>.</span>suffix</span></span>
            try</span>:</span></span>
                with</span> open</span>(</span>path</span>, '</span>r</span>',</span> encoding</span>=</span>'</span>utf-8</span>')</span> as</span> f</span>:</span></span>
                    line_count</span> =</span> sum</span>(</span>1</span> for</span> _</span> in</span> f</span>)</span></span>
                    </span></span>
                stats</span>['</span>total_lines</span>']</span> +=</span> line_count</span></span>
                stats</span>['</span>total_files</span>']</span> +=</span> 1</span></span>
                </span></span>
                if</span> ext</span> not in</span> stats</span>['</span>files_by_extension</span>']:</span></span>
                    stats</span>['</span>files_by_extension</span>'][</span>ext</span>]</span> =</span> {</span></span>
                        '</span>files</span>':</span> 0</span>,</span></span>
                        '</span>lines</span>':</span> 0</span></span>
                    }</span></span>
                </span></span>
                stats</span>['</span>files_by_extension</span>'][</span>ext</span>]['</span>files</span>']</span> +=</span> 1</span></span>
                stats</span>['</span>files_by_extension</span>'][</span>ext</span>]['</span>lines</span>']</span> +=</span> line_count</span></span>
                    </span></span>
            except</span> (</span>UnicodeDecodeError</span>,</span> PermissionError</span>):</span></span>
                continue</span></span>
    </span></span>
    return</span> stats</span></span></code></pre>
This script provides more detailed statistics and can be easily modified to:</p>

Exclude certain directories (like node_modules</code> or .git</code>)</li>
Count only specific types of lines</li>
Generate custom reports</li>
</ul>
Best Practices</h2>
When counting lines in your source code, consider:</p>

Consistency</strong>: Use the same tool and settings across your project for meaningful comparisons over time.</li>
Documentation</strong>: Document which tool and settings you use for line counting in your project documentation.</li>
Automation</strong>: Integrate line counting into your CI/CD pipeline to track changes over time.</li>
Context</strong>: Remember that line count is just one metric - it doesn’t necessarily correlate with complexity or quality.</li>
</ol>
Conclusion</h2>
While line count isn’t a perfect metric for code complexity or project size, it’s a useful baseline metric that’s easy to track. Whether you choose the simple wc</code> command, the comprehensive CLOC tool, or a custom solution depends on your specific needs:</p>

Use wc</code> for quick, rough estimates</li>
Use CLOC for detailed analysis and reporting</li>
Create a custom solution when you need specific features or integration with your workflow</li>
</ul>
Remember that the goal isn’t just to count lines, but to gain insights that help you better understand and manage your codebase.</p>


Debugging Git GPG Signing Issuese
2024-11-27T00:00:00+00:00
When working with signed Git commits, you might encounter this error:</p>
error:</span> gpg failed to sign the data:</span></span>
gpg:</span> skipped</span> "</span>[EMAIL]</span>"</span>: No secret key</span></span>
[</span>GNUPG:</span>]</span> INV_SGNR 9 </span>[</span>USER</span>]</span></span>
[</span>GNUPG:</span>]</span> FAILURE sign 17</span></span>
gpg:</span> signing failed: No secret key</span></span>
</span>
fatal:</span> failed to write commit object</span></span></code></pre>
This error occurs when you try to create a signed Git commit (using the -S</code> flag) but GPG can’t find the corresponding secret key for your email address. Let’s walk through how to diagnose and fix this issue.</p>
Checking Your GPG Keys</h2>
First, check if you have any GPG keys installed:</p>
gpg</span> --list-secret-keys --keyid-format=long</span></span></code></pre>
This command will show output similar to:</p>
/home/user/.gnupg/pubring.kbx</span></span>
-------------------------------</span></span>
sec</span>   ed25519/KEYID 2024-11-06</span> [SC]</span></span>
      FULL_KEYID</span></span>
uid</span>                 [ultimate] User Name </span><</span>email@example.com</span>></span></span>
ssb</span>   cv25519/SUBKEY 2024-11-06</span> [E]</span></span></code></pre>If You Have a Key</h2>
If you see output like above, you already have a GPG key. The key ID is the string after “ed25519/” in the sec</code> line. You’ll need to configure Git to use this key:</p>
git</span> config</span> --global</span> user.signingkey YOUR_KEY_ID</span></span></code></pre>
Also ensure your Git email matches the GPG key email:</p>
git</span> config</span> --global</span> user.email</span> "</span>your.email@example.com</span>"</span></span></code></pre>If You Don’t Have a Key</h2>
If no keys are listed, you’ll need to generate a new one:</p>
gpg</span> --full-generate-key</span></span></code></pre>
Follow the prompts to create your key. Make sure to use the same email address that you use with Git.</p>
Additional Configuration</h2>
Sometimes, you might need to explicitly tell Git which GPG program to use:</p>
git</span> config</span> --global</span> gpg.program</span> $(</span>which</span> gpg</span>)</span></span></code></pre>Testing Your Configuration</h2>
After setting everything up, try creating a signed commit:</p>
git</span> commit</span> -S -m</span> "</span>Your commit message</span>"</span></span></code></pre>Troubleshooting Tips</h2>
If you’re still having issues:</p>

Verify your GPG key email matches your Git email</li>
Ensure your GPG key hasn’t expired</li>
Check if your key has signing capability (look for [S] in the key capabilities)</li>
Make sure you’re using the correct key ID</li>
</ol>
Alternative: Unsigned Commits</h2>
If you need to make a commit without signing (assuming your repository allows it), you can simply omit the -S</code> flag:</p>
git</span> commit</span> -m</span> "</span>Your commit message</span>"</span></span></code></pre>Security Note</h2>
Signing your Git commits adds an extra layer of security by verifying that commits actually came from you. It’s especially important for open-source projects or when working in larger teams. However, make sure to keep your GPG private key secure and never share it with others.</p>
Remember that you can also configure Git to sign all commits by default:</p>
git</span> config</span> --global</span> commit.gpgsign</span> true</span></span></code></pre>
This way, you won’t need to add the -S</code> flag to every commit command.</p>
Conclusion</h2>
GPG signing issues in Git are usually straightforward to fix once you understand the relationship between your GPG keys and Git configuration. The key is to ensure that Git knows which GPG key to use and that the key is properly set up with your correct email address.</p>


Computing SHA256 Hashes for Binary Files: A Quick Guide
2024-11-27T00:00:00+00:00
When distributing binary files, it’s crucial to provide cryptographic hashes so users can verify the integrity of their downloads. This guide shows how to generate SHA256 hashes for multiple binary files across different platforms.</p>
The Problem</h2>
Let’s say you have a set of binary files for different platforms and architectures:</p>
keeper-darwin-arm64</span></span>
keeper-linux-amd64</span></span>
keeper-linux-arm64</span></span>
nexus-darwin-arm64</span></span>
nexus-linux-amd64</span></span>
nexus-linux-arm64</span></span>
spike-darwin-arm64</span></span>
spike-linux-amd64</span></span>
spike-linux-arm64</span></span></code></pre>
You want to generate SHA256 hash files for each binary, with each hash saved in its own file next to the binary.</p>
Platform-Specific Solutions</h2>
On macOS</h3>
On macOS, we use the shasum</code> command with the -a 256</code> flag to specify SHA256:</p>
for</span> file</span> in</span> keeper-* nexus-* spike-*</span>;</span> do</span></span>
    shasum</span> -a 256</span> "</span>$file</span>"</span> ></span> "</span>$file</span>.sum.txt</span>"</span></span>
done</span></span></code></pre>On Linux</h3>
Linux systems typically use sha256sum</code>:</p>
for</span> file</span> in</span> keeper-* nexus-* spike-*</span>;</span> do</span></span>
    sha256sum</span> "</span>$file</span>"</span> ></span> "</span>$file</span>.sum.txt</span>"</span></span>
done</span></span></code></pre>What This Does</h2>
The script will:</p>

Loop through all files matching the patterns keeper-*</code>, nexus-*</code>, and spike-*</code></li>
For each file, compute its SHA256 hash</li>
Save the hash and filename in a corresponding .sum.txt</code> file</li>
</ol>
For example, if you have a file named keeper-darwin-arm64</code>, it will create keeper-darwin-arm64.sum.txt</code> containing something like:</p>
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855  keeper-darwin-arm64</span></span></code></pre>Verifying Hashes</h2>
Users can verify the files using:</p>
On macOS:</p>
shasum</span> -a 256 -c</span> filename.sum.txt</span></span></code></pre>
On Linux:</p>
sha256sum</span> -c</span> filename.sum.txt</span></span></code></pre>Best Practices</h2>

Always use quotation marks around filenames in scripts to handle spaces and special characters</li>
Keep hash files alongside binaries for easy reference</li>
Consider also creating a single file containing all hashes for batch verification</li>
Document which hashing algorithm was used (in this case, SHA256)</li>
</ol>
This approach provides a secure way to distribute binaries while allowing users to verify their integrity through cryptographic hashes.</p>


SQLite Security: Understanding Authentication and Protectio
2024-11-27T00:00:00+00:00
SQLite is unique among database management systems in that it doesn’t come with built-in password protection or user authentication. This might seem strange at first, especially if you’re familiar with other databases like MySQL or PostgreSQL. However, understanding how SQLite handles security is crucial for developers building applications with this popular database.</p>
Why Doesn’t SQLite Have Passwords?</h2>
SQLite is a serverless database, which means it operates quite differently from client-server database systems. Instead of running as a separate service that accepts connections from multiple clients, SQLite directly reads and writes to a single file on your disk. This fundamental architectural difference explains the absence of traditional authentication mechanisms.</p>
How to Secure Your SQLite Database</h2>
Despite not having built-in password protection, there are several effective ways to secure your SQLite database:</p>
1. File System Permissions</h3>
The most basic and often most effective way to protect your SQLite database is through your operating system’s file permissions. Here’s how you can implement this:</p>


On Unix-like systems (Linux, macOS):</p>
chmod</span> 600</span> mydatabase.db</span></span></code></pre>
This command restricts read and write access to only the file owner.</p>
</li>

On Windows:
Use the file properties dialog or NTFS permissions to restrict access to specific users or groups.</p>
</li>
</ul>
2. File Encryption</h3>
For enhanced security, you can encrypt your entire SQLite database file. There are several approaches:</p>

Use SQLite Encryption Extension (SEE)</li>
Implement transparent disk encryption</li>
Use third-party encryption tools</li>
Create your own encryption wrapper</li>
</ul>
3. Application-Level Authentication</h3>
Many developers implement security at the application level. This approach involves:</p>

Building a user authentication system in your application</li>
Managing access control through your application’s code</li>
Creating middleware that checks user credentials before allowing database access</li>
</ul>
Best Practices for SQLite Security</h2>
To maintain a secure SQLite implementation:</p>

Never store your database file in a publicly accessible directory</li>
Regularly backup your database file</li>
Implement proper input validation to prevent SQL injection attacks</li>
Consider using prepared statements for all database queries</li>
Monitor file system permissions regularly</li>
Keep your SQLite library updated to the latest version</li>
</ol>
When to Consider Alternative Databases</h2>
While SQLite’s security model works well for many use cases, you might want to consider a different database system if you need:</p>

Built-in user authentication</li>
Fine-grained access control</li>
Multiple concurrent users with different permission levels</li>
Network-based access control</li>
</ul>
Conclusion</h2>
SQLite’s approach to security might be different from what you’re used to, but it’s not inherently less secure. By understanding its serverless nature and implementing appropriate security measures at the file system and application levels, you can build robust and secure applications with SQLite. The key is choosing the right security measures for your specific use case and implementing them correctly.</p>
Remember: security is only as strong as its weakest link. Always consider your entire application’s security architecture, not just database access control.</p>


Managing Background Processes in Bash: A Complete Guide
2024-11-24T00:00:00+00:00
When developing applications or running multiple services locally, you often need to run several scripts simultaneously. While you could open multiple terminal windows, a more elegant solution is to manage these processes programmatically. In this post, I’ll show you how to create a robust script that can run multiple processes in the background, manage their logs, and clean up properly when shutting down.</p>
The Challenge</h2>
Common scenarios where you might need this approach include:</p>

Running multiple microservices locally for development</li>
Starting various components of a distributed system</li>
Running long-running tasks that need to be monitored</li>
</ul>
The key requirements for our solution are:</p>

Run multiple scripts in the background</li>
Capture logs from each process</li>
Clean up processes properly when the main script exits</li>
Handle interrupts gracefully</li>
</ol>
The Solution</h2>
Here’s a complete script that handles all these requirements:</p>
#!/bin/bash</span></span>
</span>
declare</span> -a</span> BG_PIDS</span></span>
LOG_DIR</span>=</span>"</span>logs</span>"</span></span>
</span>
cleanup</span>() {</span></span>
    echo</span> "</span>Cleaning up background processes...</span>"</span></span>
    for</span> pid</span> in</span> "${</span>BG_PIDS</span>[</span>@</span>]}";</span> do</span></span>
        if</span> kill</span> -0</span> "</span>$pid</span>"</span> 2></span>/dev/null</span>;</span> then</span></span>
            echo</span> "</span>Killing process </span>$pid</span>"</span></span>
            kill</span> "</span>$pid</span>"</span></span>
            wait</span> "</span>$pid</span>"</span> 2></span>/dev/null</span></span>
        fi</span></span>
    done</span></span>
    exit</span></span>
}</span></span>
</span>
trap</span> cleanup EXIT INT TERM</span></span>
</span>
mkdir</span> -p</span> "</span>$LOG_DIR</span>"</span></span>
</span>
run_background</span>() {</span></span>
    local</span> script</span>=</span>"</span>$1</span>"</span></span>
    local</span> logfile</span>=</span>"</span>$LOG_DIR</span>/</span>$(</span>basename</span> "</span>$script</span>")</span>.log</span>"</span></span>
    </span></span>
    if</span> [</span> ! -x</span> "</span>$script</span>"</span> ]</span>;</span> then</span></span>
        echo</span> "</span>Error: </span>$script</span> is not executable</span>"</span></span>
        return</span> 1</span></span>
    fi</span></span>
    </span></span>
    "</span>$script</span>"</span> ></span> "</span>$logfile</span>"</span> 2>&1</span> &</span></span>
    local</span> pid</span>=</span>$!</span></span>
    BG_PIDS</span>+=</span>("</span>$pid</span>")</span></span>
    echo</span> "</span>Started </span>$script</span> with PID </span>$pid</span>, logging to </span>$logfile</span>"</span></span>
}</span></span>
</span>
run_background</span> "</span>./hack/spike-agent-starter.sh</span>"</span></span>
# run_background "./path/to/another/script.sh"</span></span>
</span>
echo</span> "</span>Scripts running in background. Logs in </span>$LOG_DIR</span>. Press Ctrl+C to stop all processes.</span>"</span></span>
wait</span></span></code></pre>How It Works</h2>
Let’s break down the key components:</p>
Process Management</h3>
The script uses an array (BG_PIDS</code>) to keep track of all background processes. This is crucial for proper cleanup later.</p>
declare</span> -a</span> BG_PIDS</span></span></code></pre>Log Management</h3>
Each process gets its own log file in a dedicated logs directory:</p>
LOG_DIR</span>=</span>"</span>logs</span>"</span></span>
mkdir</span> -p</span> "</span>$LOG_DIR</span>"</span></span></code></pre>The Cleanup Function</h3>
The cleanup function is responsible for gracefully shutting down all background processes:</p>
cleanup</span>() {</span></span>
    echo</span> "</span>Cleaning up background processes...</span>"</span></span>
    for</span> pid</span> in</span> "${</span>BG_PIDS</span>[</span>@</span>]}";</span> do</span></span>
        if</span> kill</span> -0</span> "</span>$pid</span>"</span> 2></span>/dev/null</span>;</span> then</span></span>
            echo</span> "</span>Killing process </span>$pid</span>"</span></span>
            kill</span> "</span>$pid</span>"</span></span>
            wait</span> "</span>$pid</span>"</span> 2></span>/dev/null</span></span>
        fi</span></span>
    done</span></span>
    exit</span></span>
}</span></span></code></pre>Signal Handling</h3>
The script uses trap</code> to ensure cleanup happens in all exit scenarios:</p>
trap</span> cleanup EXIT INT TERM</span></span></code></pre>
This catches:</p>

Normal script exit (EXIT)</li>
Ctrl+C interrupts (INT)</li>
Termination signals (TERM)</li>
</ul>
Running Background Processes</h3>
The run_background</code> function handles starting processes and setting up their logs:</p>
run_background</span>() {</span></span>
    local</span> script</span>=</span>"</span>$1</span>"</span></span>
    local</span> logfile</span>=</span>"</span>$LOG_DIR</span>/</span>$(</span>basename</span> "</span>$script</span>")</span>.log</span>"</span></span>
    </span></span>
    if</span> [</span> ! -x</span> "</span>$script</span>"</span> ]</span>;</span> then</span></span>
        echo</span> "</span>Error: </span>$script</span> is not executable</span>"</span></span>
        return</span> 1</span></span>
    fi</span></span>
    </span></span>
    "</span>$script</span>"</span> ></span> "</span>$logfile</span>"</span> 2>&1</span> &</span></span>
    local</span> pid</span>=</span>$!</span></span>
    BG_PIDS</span>+=</span>("</span>$pid</span>")</span></span>
    echo</span> "</span>Started </span>$script</span> with PID </span>$pid</span>, logging to </span>$logfile</span>"</span></span>
}</span></span></code></pre>Usage</h2>

Save the script as run-background.sh</code></li>
Make it executable:chmod</span> +x run-background.sh</span></span></code></pre></li>
Add your scripts to the main execution section:run_background</span> "</span>./your-script.sh</span>"</span></span></code></pre></li>
Run it:./run-background.sh</span></span></code></pre></li>
</ol>
Best Practices</h2>

Always check executability</strong>: The script verifies that each program is executable before attempting to run it.</li>
Proper signal handling</strong>: Using trap</code> ensures no processes are left running.</li>
Organized logging</strong>: Each process gets its own log file, making debugging easier.</li>
Clean exit handling</strong>: The cleanup function verifies each process exists before attempting to kill it.</li>
</ol>
Common Issues and Solutions</h2>

Zombie Processes</strong>: The script uses wait</code> to properly reap child processes.</li>
Log Management</strong>: Logs are automatically organized by script name in the logs directory.</li>
Permission Issues</strong>: The script checks for executable permissions before running each program.</li>
</ol>
Conclusion</h2>
This script provides a robust foundation for managing background processes in a development environment. It’s particularly useful for microservices development, where you need to run multiple services simultaneously.</p>
Remember to modify the script paths and add any specific error handling your use case might require. The modular nature of the script makes it easy to extend with additional functionality like log rotation or process monitoring.</p>


Understanding Unix Directory Permissions: A Common Pitfall
2024-11-24T00:00:00+00:00
When working with Unix-like systems, you might occasionally encounter situations where you can’t create files in a directory even though you own it. This usually happens because of a common misunderstanding about how directory permissions work in Unix systems.</p>
The Problem</h2>
Let’s look at a real-world example. Consider this output from ls -al</code>:</p>
drw-------</span>  2</span> volkan volkan</span>  4096</span> Nov</span> 15</span> 15:22 .spike</span></span></code></pre>
At first glance, this might seem fine - the owner has read and write permissions (rw-</code>). However, trying to create a file in this directory will fail. Why?</p>
Understanding Directory Permissions</h2>
In Unix systems, directory permissions work differently than file permissions. The permission bits have different meanings when applied to directories:</p>

Read (r)</strong>: Allows listing directory contents</li>
Write (w)</strong>: Allows creating and deleting files within the directory</li>
Execute (x)</strong>: Allows accessing the directory and its contents</li>
</ul>
The crucial detail here is that the execute</strong> permission is required to use a directory effectively. Without it, you can’t:</p>

Enter the directory (cd</code>)</li>
Access files within it</li>
Create new files</li>
Delete existing files</li>
</ul>
Breaking Down the Permission String</h2>
Let’s decode drw-------</code>:</p>

d</code>: This is a directory</li>
rw-</code>: Owner has read and write permissions, but no execute</li>
---</code>: Group has no permissions</li>
---</code>: Others have no permissions</li>
</ul>
This translates to mode 600</code> in octal notation. However, this is rarely what you want for a directory.</p>
The Solution</h2>
To fix this, you need to add the execute permission for the owner. There are two ways to do this:</p>
Using symbolic mode:</p>
chmod</span> u+x ~/.spike</span></span></code></pre>
Or using octal mode (more common):</p>
chmod</span> 700</span> ~/.spike</span></span></code></pre>
After this change, the permission string will show as drwx------</code>, giving you full control over the directory.</p>
Best Practices</h2>
For private directories that only you should access:</p>

Use mode 700</code> (rwx------</code>)</li>
This gives you full permissions while keeping the directory private</li>
It’s more secure than 777</code> which would allow anyone to access the directory</li>
</ul>
For shared directories:</p>

Consider who needs access and adjust group permissions accordingly</li>
Common modes include 750</code> (rwxr-x---</code>) for group-readable directories</li>
Always be cautious with world-readable/writable permissions</li>
</ul>
Command Reference</h2>
Useful commands for managing directory permissions:</p>
# View permissions in human-readable format</span></span>
ls</span> -al</span> directory_name</span></span>
</span>
# View permissions in numeric format</span></span>
stat</span> -c</span> "</span>%a</span>"</span> directory_name</span></span>
</span>
# Change permissions using symbolic notation</span></span>
chmod</span> u+x directory_name</span>  # Add execute for user</span></span>
chmod</span> g+rx directory_name</span> # Add read and execute for group</span></span>
</span>
# Change permissions using octal notation</span></span>
chmod</span> 700</span> directory_name</span>  # rwx------ (private)</span></span>
chmod</span> 750</span> directory_name</span>  # rwxr-x--- (group readable)</span></span></code></pre>
Remember: when working with directories, the execute permission is essential for basic operations. Always ensure it’s set appropriately for your use case.</p>
Happy permissions managing! 🐧</p>


A Glossary of Mostly Developer-Related Things
2021-11-27T00:00:00+00:00

    </p>
    
The tech industry loves its TLAs.</p>
</div>
We love our terms and acronyms, don’t we? They help us communicate complex
notions with just a few characters; however, they can also be an obstacle when
you are learning new stuff. This page covers a list of mostly developer-related
terms and acronyms with links to further explanations about them.</p>

A/B Testing</a></li>
API</a></li>
Adaptive Design</a></li>
Agile Software Development</a></li>
Algorithm</a></li>
Automation</a></li>
Backlog</a></li>
bash</a></li>
BDD (Behavior-Driven
Development</em>)</a></li>
Big Data</a></li>
Big Query</a></li>
Browser</a></li>
Bug</a></li>
Bundling</a></li>
Burn Rate</a></li>
C#</a></li>
C++</a></li>
CMS (Content Management
System</em>)</a></li>
CNCF (Cloud Native Computing Foundation</em>)</a></li>
CPU (Central Processing
Unit</em>)</a></li>
CRM (Customer Relationship
Management</em>)</a></li>
CSS (Cascading Style
Sheet</em>)</a></li>
CTA (Call to
Action</em>)</a></li>
C</a></li>
Cache</a></li>
Churn Rate</a></li>
Code Editor</a></li>
CommonJS</a></li>
Container</a></li>
CI (Continuous
Integration</em>)</a></li>
Cookie</a></li>
Crawl</a></li>
DNS (Domain Name System</em>)</a></li>
DNS Record Types</a></li>
DPI (Dots Per Inch</em>)</a></li>
Data Structure</a></li>
Debugging</a></li>
Deployment</a></li>
Design</a></li>
DevOps</a></li>
Docker</a></li>
Domain</a></li>
ECMAScript</a></li>
Erlang</a></li>
FMP (First Meaningful Paint</em>)</a></li>
FP (Functional
Programming</em>)</a></li>
FTP (File Transfer
Protocol</em>)</a></li>
FaaS</a></li>
Favicon</a></li>
Framework</a></li>
Front End and Back End</a></li>
Full-Stack</a></li>
GUI (Graphical User
Interface</em>)</a></li>
GitHub</a></li>
Git</a></li>
Go</a></li>
GraphQL</a></li>
Haskell</a></li>
HTML (Hypertext Markup Language</em>)</a></li>
HTTP Response Status Codes</a></li>
HTTP (Hypertext Transfer
Protocol</em>)</a></li>
humans.txt</a></li>
Hybrid App</a></li>
Hypervisor</a></li>
IaaS (Infrastructure as a
Service</em>)</a></li>
Inbound Marketing</a></li>
Information Architecture</a></li>
Integration Testing</a></li>
JAM Stack</a></li>
JavaScript</a></li>
Java</a></li>
Kaizen</a></li>
Kanban</a></li>
Kubernetes</a></li>
LAMP Stack</a></li>
Library</a></li>
Lisp</a></li>
Local Storage</a></li>
MEAN Stack</a></li>
MERN Stack</a></li>
Mocking</a></li>
MQTT (Message Queue Telemetry Transport</em>)</a></li>
MTTR (Mean Time to
Repair</em>)</a></li>
MVP (Minimum Viable
Product</em>)</a></li>
Machine Learning</a></li>
Minification</a></li>
Mobile App</a></li>
Mockup</a></li>
Module</a></li>
Navigation</a></li>
NIH (Not Invented Here</em>)</a></li>
NoSQL</a></li>
Node.js</a></li>
Orchestration</a></li>
OOP (Object-Oriented
Programming</em>)</a></li>
OOTB (Out of the
Box</em>)</a></li>
OSI Model</a></li>
OWASP (Open Web Application Security Project</em>)</a></li>
Operating System</a></li>
PaaS _Platform as a
Service</em>)</a></li>
Plugin</a></li>
Pod</a></li>
Production</a></li>
Protocol Buffers</a></li>
Prototype</a></li>
Python</a></li>
RAM (Random-Access
Memory</em>)</a>)</li>
REST (Representational State
Transfer</em>)</a></li>
Redirect</a></li>
Registrar</a></li>
Resolution</a></li>
Responsive Design</a></li>
Roadmap</a></li>
robots.txt</a></li>
Ruby</a></li>
Rust</a></li>
SMTP (Simple Mail Transfer
Protocol</em>)</a></li>
SQL (Structured Query Language</em>)</a></li>
SSD (Solid-State Drive</em>)</a></li>
SSH (Secure Shell</em>)</a></li>
SaaS (Software as a
Service</em>)</a></li>
Scheme</a></li>
Scrape</a></li>
Scrum</a></li>
Server</a></li>
Separation of Concerns</a></li>
Spying</a></li>
Serverless</a></li>
Session Storage</a></li>
Sitemap</a></li>
Smalltalk</a></li>
Software Stack</a></li>
Source Control</a></li>
SOLID</a></li>
Sprint</a></li>
TDD (Test-Driven
Development</em>)</a></li>
TLS</a></li>
TTFB (Time to First
Byte</em>)</a></li>
Tags</a></li>
Template</a></li>
Test Stub</a></li>
Text Editor</a></li>
UAT (User Acceptance
Testing</em>)</a></li>
UI Design</a></li>
UI (User Interface</em>)</a></li>
UX Design</a></li>
UX (User Experience</em>)</a></li>
Unit Testing</a></li>
Usability Testing</a></li>
User Agent</a></li>
User Research</a></li>
WYSIWYG (What You See Is What You
Get</em>)</a></li>
Waterfall</a></li>
Web App</a></li>
Widget</a></li>
Wireframe</a></li>
YAGNI</a></li>
zsh</a></li>
</ul>
Until next time… May the source be with you 🦄.</p>

Section Contents</h2>


Be the Next Version of Yourself</a></p>
</li>

Who Else is Ready to Hack?</a></p>
</li>

Grab Your Chisel and Start Pounding</a></p>
</li>

Unlock Your Brain’s Power: Learn Fast, Remember More</a></p>
</li>

Master Your Mind: Unleash the Power of Learning</a></p>
</li>

Resources Every Developer Must Read: No Exceptions</a></p>
</li>

Knowing JavaScript Is Not Good Enough</a></p>
</li>

Learn JavaScript the Unconventional Way</a></p>
</li>

Want to Learn JavaScript? Learn Haskell First</a></p>
</li>

▶ A Glossary of Mostly Developer-Related Things</strong></p>
</li>

Git Comfortable</a></p>
</li>

Master Your Vim-Fu</a></p>
</li>

One Does Not Simply Terminal 👌</a></p>
</li>

Paint Me Like One of Your French Design Patterns</a></p>
</li>

Tame Your Regular Expressions</a></p>
</li>

Security Is Not Optional</a></p>
</li>

You Need Testing</a></p>
</li>

A Startup Founder’s Bedtime Reading List</a></p>
</li>

Orange Is the New Purple</a></p>
</li>

Ramp Up in User Experience Design</a></p>
</li>

Get Better at Typography</a></p>
</li>

The Bottleneck Moved. The Work Did Not.</a></p>
</li>
</ul>


One Does Not Simply "Terminal" 👌
2021-11-07T00:00:00+00:00

    </p>
    
One does not simply...</p>
</div>
Getting Comfortable With the Linux Terminal</h2>
Here are some articles you can read to get more intimate with the command line:</p>

An introduction to the Linux Terminal</a></li>
Using the Terminal</a></li>
tldr Pages</a> (easier to scan than</em> man pages</em></a>, more practical</em>)</li>
Explain Shell</a> (paste your command, and let explain shell… well… explain it</em>)</li>
</ul>
Commands That You’ll Use Frequently</h2>
The more terminal you know, the more power you’ll have. Yet, here is a list of
common commands that you might want to start familiarizing yourself with:</p>
awk</code></a>,
sed</code></a>,
grep</code></a>,
sort</code></a>,
uniq</code></a>,
cat</code></a>,
cut</code></a>,
echo</code></a>,
egrep</code></a>,
fgrep</code></a>,
wc</code></a>,
less</code></a>,
more</code></a>,
ps</code></a>,
top</code></a>,
htop</code></a>,
atop</code></a>,
nmon</code></a>,
iostat</code></a>,
vmstat</code></a>,
ifconfig</code></a>,
nmap</code></a>,
tcpdump</code></a>,
ping</code></a>,
traceroute</code></a></p>
👆 These are the ones that you might use frequently. Obviously, there are more
that you might want to look into.</p>
Know Enough Shell Scripting to Be Dangerous</h2>
Here are a few guides on the topic:</p>

Bash Guide for Beginners</a></li>
Bash Scripting Tutorial</a></li>
Bash One-Liners</a></li>
Advanced Bash Scripting Guide</a></li>
Bash Cookbook</a></li>
Bash Guide</a></li>
Bash Pocket Reference</a></li>
Bash Programming Intro</a></li>
Bash Reference Manual</a></li>
Bash Scripting Cheatsheet</a></li>
Bash Shell Scripting</a></li>
Bash Wiki</a></li>
Learn Shell</a></li>
Learn X in Y Minutes Where X is Bash</a></li>
Shell Guide</a></li>
The Art of Command Line</a></li>
The Art of Command Line</a></li>
</ul>
Connecting to a Remote Server</h2>
Connecting a remote server via
SSH</strong></a>
is something you’ll have to do sooner or later.</p>

Explore Community Docs</strong></p>
If you need more than connecting to a server. Like, for example, if you need
to install and configure applications, services, proxies, firewalls,
databases,
containers, and the like, then DigitalOcean</strong>’s community tutorials</a> is
one of the best resources that you can have; closely followed by Linode</strong>’s helpful articles</a>.</p>
</blockquote>
The only commands you need to master probably
are ssh</code></a>
and ssh-copy-id</code></a>.</p>
Below, I’ll list some terminal emulators that you might want to try out too;
however, most of the time, the default terminal emulator on your operating
system will be sufficient for your needs.</p>

Windows and Terminal</strong>

If you have a Windows development machine and you are planning to work on
Linux-like environments, do yourself a favor and give
Windows Subsystem for Linux</a>
a go. You’ll thank me later.</p>
</blockquote>
Cross-Platform Terminal Emulators</h2>
Alacritty</h3>
Alacritty</strong></a> is the fastest</strong>
terminal emulator that you can find around. It’s fast, lightweight, based on
OpenGL.</p>
However, when I say lightweight</strong>, it truly is</strong> lightweight. You cannot
find tabs, split windows, and other fancy add-ons that other terminal emulators
provide.</p>
To be productive with alacritty</strong></a>,
you’ll have to learn tmux</strong></a>
too, so that you’ll have an equivalent tabbed user interface experience that you might be
used to from other terminal emulators.</p>

💁‍</p>
Here’s a quick and easy guide to tmux</strong></a>.</p>
</blockquote>
Kitty</h3>
Kitty</strong></a> is another fast, GPU-based
terminal. So what makes it different than,
say alacritty</a>? It is feature-rich,
scriptable, and composable while still being fast and minimalistic.</p>
Hyper</h3>
Hyper</strong></a> is an
electron</a>-based terminal emulator. It
is built on HTML/CSS/JS. Fully extensible, absolutely hackable. If you want
something customizable, with hyper</a> sky is the limit.</p>
Mosh</h3>
Mosh</strong></a> is especially useful when you are, say, using your
terminal on a train, where connectivity is intermittent and unreliable.</p>
It is a replacement for interactive SSH terminals. It works wonders, especially
over Wi-Fi, cellular, and long-distance links.</p>
Terminus</h3>
Terminus</strong></a> boast to be a customizable
terminal for the modern age, and it does look pretty slick if you ask me.</p>
Linux Terminal Emulators</h2>
For the Linux UI fans out there, here are a few terminal emulators that you can
try.</p>

Guake</strong></a>, is my preferred terminal on my
Ubuntu</strong></a>, mostly because I’m so used to
the Quake</a>-style keyboard
shortcuts to show and hide it. If you are a gamer, it becomes second nature to
use it.</li>
Terminator</strong></a> is really useful if
you find yourself needing to split your window horizontally and vertically to
see multiple terminal sessions simultaneously.</li>
Konsole</strong></a> is another popular option to try out.</li>
So is Tilda</strong></a>.</li>
</ul>
Mac Terminal Emulators</h2>
Mac Terminal emulators come and go all the time, yet there’s only a single one
that stays and gets better year after year: iTerm2</strong></a>.</p>
While the default Terminal app is more than enough for your programming needs,
in case you want to spice things up a bit, you can try out
iTerm2</strong></a>. It provides a split window view similar
to terminator</a>, so if you come from the
Unix world and seek a similar experience, iTerm2</a> can
be your ally.</p>
Windows Terminal Emulators</h3>
To be honest, I don’t use Terminal on Windows too much; however, the following
are the terminal emulators I’ve used and liked over time. Pick your own poison
🙂.</p>

Windows Terminal</strong></a></li>
Conemu</strong></a></li>
Fluent Terminal</strong></a></li>
Powershell</strong></a>
(it’s a shell, not a terminal, but still very</strong> useful</em>)</li>
PuTTY</strong></a></li>
ZOC Terminal</strong></a></li>
Cmder</strong></a></li>
</ul>
Shells</h2>
Picking a terminal emulator is the first step in the journey of making your
terminal experience better. Next up is picking up a shell</strong>.</p>
Z-shell</strong></a> is popular nowadays, and
whoever uses Z-shell</a> also installs
Oh My Zsh</strong></a> as a sane starting point in customizing their
shell.</p>
There is a zsh Quickstart Kit</a>
that you might want to look at too.</p>
Fish</strong></a> is another popular shell that is famous for
its autocomplete support.</p>
Ah, there is also oh my fish</strong></a> to
set up your fish 🐠.</p>
Terminal Utilities</h2>
Here I’m listing terminal tools and utilities I’ve found useful over the course
of years.</p>
Find; Search; Filter Files, Folders and Streams</h3>

ack</strong></a> (this is a must-learn, especially if you
search source code a lot</em>)</li>
fzf</strong></a> (Fuzzy Finder: Another finder
utility that you’d question how you lived without it</em>)</li>
grep</strong></a> (must be in your toolbox</em>)</li>
peco</strong></a> (peco</strong> is a simplistic,
interactive filtering tool)</li>
ripgrep</strong> (ripgrep</strong> recursively searches your directories</em>)</li>
The Silver Searcher</strong></a> (a code searching tool
similar to ack</strong></em>)</li>
fx</strong></a> (a utility to view JSON in
terminal</em>)</li>
jq</strong></a> (so as this one</em>)</li>
sed</strong></a> (Stream
Editor—another powerful tool to learn)</li>
zoxide</strong></a> (alias cd zoxide</em>)</li>
</ul>
Help</h3>

ExplainShell</strong></a> is a web app to explain the
shell command you paste in.</li>
fuck</strong></a> is a command-line utility that
recovers you from your mistakes.</li>
how2</strong></a> finds the simplest way to do
something in a Unix shell.</li>
howdoi</strong></a> provides instant coding answers
via the command line.</li>
tldr-pages</strong></a> is for those who are
tired of reading the full manual.</li>
tldr.sh</strong></a> is the website for tldr-pages</code>.</li>
</ul>
Terminal Multiplexing</h3>

screen</strong></a></li>
tmux</strong></a></li>
tmuxinator</strong></a></li>
</ul>
File and Folder Management</h3>

exa</strong></a> (alias ls exa</em>)</li>
trash</strong></a> (moves files and
directories to trash</em>)</li>
jump</strong></a> (jump helps you navigate
faster by learning your habits</em>)</li>
autojump</strong></a> (similar to jump</strong></em>)</li>
lazy-cd</strong></a> (path bookmarking for
bash</em>)</li>
aliasme</strong></a> (a shell script to organize
your aliases</em>)</li>
fkill-cli</strong></a> (fabulously kill
processes with extreme prejudice</em>)</li>
direnv</strong></a> (unclutter your .profile</code></em>)</li>
</ul>
Monitoring and System Info</h3>

htop</strong></a> (better</em> 
top</code></em></a>)</li>
vtop</strong></a> (similar to htop</strong>, but
graphical</em>)</li>
glances</strong></a> (better htop</strong> 🙂</em>)</li>
neofetch</strong></a> (a command-line system
information tool</em>)</li>
progress</strong></a> (shows the progress
of cp</code>, mv</code>, dd</code>, etc.)</li>
</ul>
Getting $#!% Done</h3>

todo.txt</strong></a> (a future-proof task tracking tool</em>)</li>
</ul>
Mac-Specific</h3>

mas</strong></a> (Mac AppStore command-line
interface because why not 🤷‍♂️</em>)</li>
homebrew</strong></a> (the closest you can get to a package
manager for Mac OS</em>)</li>
macports</strong></a> (similar to homebrew</strong></em>)</li>
</ul>
Conclusion</h2>
That’s a lot of tools and utilities to get you started with the terminal. I
hope you find them useful.</p>
Until next time… May the source be with you 🦄.</p>

Section Contents</h2>


Be the Next Version of Yourself</a></p>
</li>

Who Else is Ready to Hack?</a></p>
</li>

Grab Your Chisel and Start Pounding</a></p>
</li>

Unlock Your Brain’s Power: Learn Fast, Remember More</a></p>
</li>

Master Your Mind: Unleash the Power of Learning</a></p>
</li>

Resources Every Developer Must Read: No Exceptions</a></p>
</li>

Knowing JavaScript Is Not Good Enough</a></p>
</li>

Learn JavaScript the Unconventional Way</a></p>
</li>

Want to Learn JavaScript? Learn Haskell First</a></p>
</li>

A Glossary of Mostly Developer-Related Things</a></p>
</li>

Git Comfortable</a></p>
</li>

Master Your Vim-Fu</a></p>
</li>

▶ One Does Not Simply Terminal 👌</strong></p>
</li>

Paint Me Like One of Your French Design Patterns</a></p>
</li>

Tame Your Regular Expressions</a></p>
</li>

Security Is Not Optional</a></p>
</li>

You Need Testing</a></p>
</li>

A Startup Founder’s Bedtime Reading List</a></p>
</li>

Orange Is the New Purple</a></p>
</li>

Ramp Up in User Experience Design</a></p>
</li>

Get Better at Typography</a></p>
</li>

The Bottleneck Moved. The Work Did Not.</a></p>
</li>
</ul>


mTLS With SPIRE: Part 2: Creating the Server App
2021-10-19T00:00:00+00:00
mTLS With SPIRE: Part 2 — Creating the Server App</h2>


    </p>
    
mTLS With SPIRE: Part 2: Creating the Server App</p>
</div>
We’ll start by creating a server application. Once the server is ready, we’ll
continue with the client application on the next video.</p>

  </iframe>
</div>
mTLS With SPIRE: Part 2: Creating the Server App</p>

Playlist</h2>


mTLS With SPIRE: Part 1: Introduction</a></p>
</li>

▶ mTLS With SPIRE: Part 2: Creating the Server App</strong></p>
</li>

mTLS With SPIRE: Part 3: Creating the Client App</a></p>
</li>

mTLS With SPIRE: Part 4: Containerizing the Server App</a></p>
</li>

mTLS With SPIRE: Part 5: Containerizing the Client App</a></p>
</li>

mTLS With SPIRE: Part 6: Rolling Out SPIRE to the Cluster</a></p>
</li>

mTLS With SPIRE: Part 7: Registering Nodes and Workloads to SPIRE</a></p>
</li>

mTLS With SPIRE: Part 8: Configuring the Server to Use SPIRE mTLS</a></p>
</li>

mTLS With SPIRE: Part 9: Configuring the Client to Use SPIRE mTLS</a></p>
</li>

mTLS With SPIRE: Part 10: Establishing Cross-Cluster mTLS</a></p>
</li>
</ul>
Tools and Technologies Mentioned</h2>
Here are the tools and technologies that were mentioned in the video, along with
related articles and other helpful links.</p>

Go</strong> Programming Language</a></li>
Using Go</strong> Modules</a></li>
Bash</strong></a></li>
gRPC</strong></a></li>
</ul>
Read the Source</h2>

Access the source code and other related assets from Zero to Hero</strong> GitHub</a>.</li>
</ul>


Assemble Your Personal Board of Advisors
2021-07-31T00:00:00+00:00

    </p>
    
Your personal board of advisors will help you navigate the tough times.</p>
</div>
Welcome to the eleventh issue of Zero to Hero</strong> Highlights.</p>
We had quite a ride in the last week. Let’s take a look at a few highlights.</p>
FizzBuzz Pro** Kubernetes Cluster is Up and Running 🤘</h2>
Well, it’s up, running; and there’s still a lot to implement, but at least I can
get a list of pods and deployments. Also, the critical services
like idm</code>, mailer</code>, crypto</code> are mostly</strong> complete.</p>
Here’s what I see when I query the cluster:</p>
$</span> kubectl get deployment</span></span>
NAME</span>        READY   UP-TO-DATE   AVAILABLE   AGE</span></span>
crypto</span>      1/1</span>     1            1</span>           3d</span></span>
idm</span>         1/1</span>     1            1</span>           3d21h</span></span>
mailer</span>      1/1</span>     1            1</span>           4d2h</span></span>
questions</span>   1/1</span>     1            1</span>           4d2h</span></span>
store</span>       1/1</span>     1            1</span>           4d2h</span></span>
</span>
$</span> kubectl get po</span></span>
NAME</span>                         READY   STATUS      RESTARTS   AGE</span></span>
crypto-84f64dc7bf-qnj8l</span>      1/1     Running</span>     0</span>          3d</span></span>
idm-844969c6dd-pzmks</span>         1/1     Running</span>     0</span>          3d21h</span></span>
mailer-67fcf8b5dc-zc8lp</span>      1/1     Running</span>     0</span>          4d2h</span></span>
questions-7f5ccd5b84-2tmdp</span>   1/1     Running</span>     0</span>          4d2h</span></span>
store-5f8b66f949-tsc42</span>       1/1     Running</span>     0</span>          4d2h</span></span>
</span>
$</span>  kubectl get ingress</span></span>
NAME</span>       CLASS    HOSTS              ADDRESS</span> </span></span>
cerberus</span>   <</span>non</span>e</span>></span>   api.fizzbuzz.pro   k8s-...amazonaws.com</span> 80</span>   10d</span></span></code></pre>
So nothing has been broken for days! Everything is healthy as a horse. Progress!</p>

I’ll be writing more articles and creating more videos about how these
services all tie together. Stay tuned.</p>
</blockquote>
Deploying a Microservice to Kubernetes</h2>
While on the topic of videos, I published a video about how you can deploy a
microservice to an AWS EKS Kubernetes cluster</a>.</p>
In the video, I start from the source code:</p>

Build the code.</li>
Containerize it.</li>
Push it to a registry.</li>
Link the registry image to Kubernetes Deployments, Services, and Pods.</li>
And more.</li>
</ul>
It’s an excellent overview of how everything ties together.</p>
Note that this is just the video</strong> part of the content. There will be an
accompanying article on Zero to Hero</strong></a> that will dive deeper and
provide you with additional bedtime reading material</em> to dig in.</p>
Installing an AWS EKS Kubernetes Cluster Using eksctl</code></h2>
The above video talks about deploying to Kubernetes,</strong> but how do we create a
Kubernetes</strong> cluster in the first place.</p>
There are many ways but
eksctl</a> is the preferred way.
As always, there’s more than mere instructions; I discuss the pros and cons of
things, and there are further reference material for the interested to do a
deeper dive.</p>
That’s more or less this week in a nutshell. So what’s coming up next?</p>
What’s on the Horizon 👩‍🍳</h2>
I have a couple of [Zero to Hero Twitch Screencasts</strong>][twitch] that I
haven’t published yet.</p>
On the FizzBuzz Pro</strong> end, I, at least, want to finish the IDM</strong> µService
endpoints (which is almost done</em>), but we’ll see how it goes.
I’ll let you know next week.</p>
Random Thought of the Week</h2>
Don’t take the phrase “you must have a mentor</em>” too literally. The reality is
you need more than a single mentor</strong>; you need your personal board of
advisors</strong> if you will. But how do you find all these people? Let’s see.</p>
I don’t want to sound cheesy, but the first step is to
know yourself</strong></a>. Finding what you
want requires knowing what you want. Then, reflect deeply and write down a *
personal vision statement</em>*. Make sure that your personal vision statement</em>
resonates with what you</strong> want to aspire to be. Not</strong> what society, your
teammates, your managers, or your family expects from you.</p>

Think about how your career aligns</strong> with your personal vision down the
road. How does your ideal life look like fifteen years ahead?

How will it be different from your present-day?</p>
</blockquote>
Then create a list of different kinds of support that you will need to
actualize</strong> that aspiration. For example, what types of support do you need to
take yourself from where you are to where you want to be?</p>
Then consider which areas are already fulfilled by mentors and helpers and which
aren’t.</p>
Do you want a few examples?</p>

Who do you go when you need to discuss some tactical advice to navigate
company internals?</li>
Where do you go for emotional support?</li>
Whom do you rely on to enhance your technical understanding?</li>
</ul>
Enhance the list as much as you can.</p>
Then for any role that is “missing</em>” a mentor, think about who could fill that
need. Does that person exist in your network, do they exist in your
second-degree network; or do you need to look even further?</p>
Based on that assessment, you can develop new relationships or strengthen the
existing ones.</p>
You’ll also find that a prospective mentor or a coach will be much</strong> inclined
to help you on a particular topic rather than the generic “would you be my
mentor?</em>” questions.</p>
In short, as I’ve been telling you a million times: do your homework</strong> before
reaching out for help.</p>
Look What I’ve Found</h2>
Here are the things that grabbed my attention this week.</p>
I typically don’t share these anywhere else.</p>
Exclusively hand-picked for you 👌. Enjoy.</p>

Middy</strong> is the stylish Node.js middleware engine for AWS Lambda</a>.</li>
Here’s how GitHub</strong> found and fixed a rare race condition in their
session handling</a>.</li>
Flash News</strong>: You can manage your complexity bias by… keeping things
simple, who knew</a>!</li>
</ul>
Thanks a Lot ❤️</h2>
That’s all for this week. Next week, I’ll gather more unique content and resources.</p>
So, until next time… May the source be with you 🦄.</p>

Issues</h2>


Issue 1: Hello World, Hello Stars, Hello Universe</a></p>
</li>

Issue 2: The Only Thing That doesn’t Change is Change Itself</a></p>
</li>

Issue 3: Know Thyself</a></p>
</li>

Issue 4: Have You Fizzed that Buzz?</a></p>
</li>

Issue 5: Be Kind</a></p>
</li>

Issue 6: Earn the Promotion You Deserve</a></p>
</li>

Issue 7: Who Else Journals Daily?</a></p>
</li>

Issue 8: Who Are You?</a></p>
</li>

Issue 9: How to Make Yourself Heard</a></p>
</li>

Issue 10: Tough Conversations</a></p>
</li>

▶ Issue 11: Assemble Your Personal Board of Advisor</strong></p>
</li>

Issue 12: What’s Your Plan</a></p>
</li>

Issue 13: Nine-to-Five? I Don’t Think So</a></p>
</li>

Issue 14: Respect and Understanding</a></p>
</li>

Issue 15: Pivoting Your Career?</a></p>
</li>

Issue 16: Ghosted?</a></p>
</li>

Issue 17: ‘Following Your Passion’ Is Hardly Enough</a></p>
</li>

Issue 18: Keep Cam and Carry On</a></p>
</li>

Issue 19: Attention, Intention, Compassion</a></p>
</li>

Issue 20: Words Matter</a></p>
</li>

Issue 21: Change Is the Only Constant</a></p>
</li>

Issue 22: Overcome the Awkward Feeling of Networking</a></p>
</li>

Issue 23: Unleash Your Curiosity: Unlock Your Potential as a Leader</a></p>
</li>

Issue 24: Interview Done. Radio Silence 🎃 What Now?</a></p>
</li>

Issue 25: Unlock Your True Potential: Make Your Hard Work Visible</a></p>
</li>

Issue 26: Winning at Work: Thriving With Difficult Colleagues</a></p>
</li>

Issue 27: Promotions Don’t Happen Overnight</a></p>
</li>
</ul>

Zero to Hero - shell-scripting

Snippet/Draft: systemd-networkd-wait-online.service Waits Too Long During Ubuntu Startup

Bulk Import Bookmarks to Shiori: A Simple Bash Script Solution

How to Use the Script</h2>

Key Features</h2>

Error Handling</h3> The script creates a timestamped log file for any failures, making it easy to identify and retry problematic URLs.</p>

Progress Tracking</h3> Real-time feedback shows exactly which URLs are being processed and their import status.</p>

Comment Support</h3> Lines starting with #</code> are treated as comments and skipped, allowing you to annotate your URL list.</p>

Cross-Platform Compatibility</h3> The script uses POSIX-compliant commands and works on Linux, macOS, and Windows (via WSL</em>).</p>

Troubleshooting</h2>

Special Characters in URLs</h3> The script handles most URLs correctly, but if you have URLs with special characters, ensure they’re properly encoded.</p>

Establishing SPIFFE Federation Between Kubernetes Clusters

Key Considerations</h2>

Bundle Rotation</h3> If the root CA in a trust domain is rotated, the updated trust bundle must be shared with the other server to maintain trust.</p>

Unique SPIFFE IDs</h3> Ensure that SPIFFE IDs are unique across trust domains to avoid collisions.</p>

Secure Transport</h3> Always exchange trust bundles securely to prevent tampering.</p>

Understanding Docker's 6MB Memory Limit: A Deep Dive

Configuration Options: What Can You Do?</h2> While this limit is hardcoded into Docker’s engine, you’re not entirely without options. Here are several approaches to dealing with this limitation:</p>

1. Adjust Your Resource Allocation</h3> The most straightforward solution is to ensure your containers have adequate memory allocation. If you’re hitting this limit, it’s worth questioning whether running with such minimal memory is truly optimal for your application.</p>

Additional Resources</h3> Docker Documentation on Resource Constraints</li> Kubernetes Memory Management Documentation</li> Container Runtime Comparisons</li> Memory Optimization Strategies for Containers</li> </ul> Happy containerizing!</p>

Installing VMware vCenter Server Appliance (vCSA): Stage 1 Deployment Guide

Installation Process</h2>

6. Network Configuration</h3>

Important Notes</h2>

How to Export Kubernetes Secrets as JSON: A Complete Guide

The Basic Approach</h2> The fundamental command to export a secret in JSON format is straightforward:</p>

Cleaning Up Cluster-Specific Information</h2> To create a clean export that removes cluster-specific metadata, we can use jq</code> to process the JSON output. Here’s the recommended approach:</p>

Parsing JWT Claims in Go: A Practical Guide

How to Decrypt Files Using age - A Quick Guide

Prerequisites</h2> age installed on your system</li> An encrypted file (base64 encoded)</li>

Security Best Practices</h2> Never share your secret key</li> Delete key files after use</li> Store encrypted files and keys separately</li> Use secure channels when transferring encrypted files</li> </ul>

Computing File Hashes in Unix Systems: A Complete Guide

Securely Generating and Storing SPIRE Agent Tokens

The Problem</h2> When working with SPIRE, we often need to generate agent tokens and store them for later use. The default spire-server token generate</code> command outputs tokens with a “Token: “ prefix, which isn’t always ideal for automation or direct use in configuration files.</p>

Conclusion</h2> This script provides a secure and automated way to generate and store SPIRE agent tokens. By removing the prefix and implementing proper error handling, it makes token management more reliable and automation-friendly.</p>

Cross-Compiling Go Applications on M3 Macs: A Practical Guide

Implementing Secure Password Input in Go CLI Applications

How to Count Lines in Your Source Code Projects: A Comprehensive Guide

Debugging Git GPG Signing Issuese

Conclusion</h2> GPG signing issues in Git are usually straightforward to fix once you understand the relationship between your GPG keys and Git configuration. The key is to ensure that Git knows which GPG key to use and that the key is properly set up with your correct email address.</p>

Computing SHA256 Hashes for Binary Files: A Quick Guide

Platform-Specific Solutions</h2>

SQLite Security: Understanding Authentication and Protectio

Error Handling</h3>
The script creates a timestamped log file for any failures, making it easy to identify and retry problematic URLs.</p>

Progress Tracking</h3>
Real-time feedback shows exactly which URLs are being processed and their import status.</p>

Comment Support</h3>
Lines starting with `#</code> are treated as comments and skipped, allowing you to annotate your URL list.</p>`

Cross-Platform Compatibility</h3>
The script uses POSIX-compliant commands and works on Linux, macOS, and Windows (via WSL</em>).</p>

Special Characters in URLs</h3>
The script handles most URLs correctly, but if you have URLs with special characters, ensure they’re properly encoded.</p>

Bundle Rotation</h3>
If the root CA in a trust domain is rotated, the updated trust bundle must be shared with the other server to maintain trust.</p>

Unique SPIFFE IDs</h3>
Ensure that SPIFFE IDs are unique across trust domains to avoid collisions.</p>

Secure Transport</h3>
Always exchange trust bundles securely to prevent tampering.</p>

Configuration Options: What Can You Do?</h2>
While this limit is hardcoded into Docker’s engine, you’re not entirely without options. Here are several approaches to dealing with this limitation:</p>

1. Adjust Your Resource Allocation</h3>
The most straightforward solution is to ensure your containers have adequate memory allocation. If you’re hitting this limit, it’s worth questioning whether running with such minimal memory is truly optimal for your application.</p>

Additional Resources</h3>

Docker Documentation on Resource Constraints</li>
Kubernetes Memory Management Documentation</li>
Container Runtime Comparisons</li>
Memory Optimization Strategies for Containers</li> </ul>
Happy containerizing!</p>

Security Best Practices</h2>

Never share your secret key</li>
Delete key files after use</li>
Store encrypted files and keys separately</li>
Use secure channels when transferring encrypted files</li> </ul>

The Problem</h2>
When working with SPIRE, we often need to generate agent tokens and store them for later use. The default `spire-server token generate</code> command outputs tokens with a “Token: “ prefix, which isn’t always ideal for automation or direct use in configuration files.</p>`

Conclusion</h2>
This script provides a secure and automated way to generate and store SPIRE agent tokens. By removing the prefix and implementing proper error handling, it makes token management more reliable and automation-friendly.</p>

`Conclusion</h2> GPG signing issues in Git are usually straightforward to fix once you understand the relationship between your GPG keys and Git configuration. The key is to ensure that Git knows which GPG key to use and that the key is properly set up with your correct email address.</p>`