Sixteen years of company IT across eleven offices in Asia Pacific. Projects and writing, for people considering working with me.
set -euo pipefail
pkgbuild \
--root "$stage" \
--identifier "$bundle_id" \
--version "$version" \
"$build/component.pkg"
productbuild \
--package "$build/component.pkg" \
--sign "$installer_cert" \
"$out/$name-$version.pkg"
xcrun notarytool submit \
"$out/$name-$version.pkg" \
--keychain-profile "$profile" --wait
xcrun stapler staple \
"$out/$name-$version.pkg"active
Author
A reference Terraform project for a hardened S3 remote backend: KMS-encrypted versioned state, environments isolated by separate AWS accounts rather than workspaces, and S3 native locking instead of a DynamoDB lock table.
View projectReplacing the DynamoDB lock table with S3 native locking, isolating environments by AWS account instead of workspaces, and the plan file mix-up that made us name every plan after its environment.
Aug 3, 2026 · 8 min read
Apr 17, 2026 · 11 min read