- Pin golang:1.25-alpine to sha256:f6751d823c26342f9506c03797d2527668d095b0a15f1862cddb4d927a7a4ced
- Pin alpine:3.19 to sha256:6baf43584bcb78f2e5847d1de515f23499913ac9f12bdf834811a3145eb11ca1
- Pin golangci-lint to v2.10.1 (was @latest)
- Pin goimports to v0.42.0 (was @latest)
Go module verification via go.sum provides cryptographic hash checking,
so version pinning is sufficient for go install commands.
- Generate random 32-byte session secret if not set via env var
- Persist to $UPAAS_DATA_DIR/session.key for container restarts
- Load existing secret from file on subsequent startups
- Change container data directory to /var/lib/upaas