{"project":{"id":"019d8a8e-79d0-46ad-a76b-72742a3a45e5","name":"pam","repository":"git@github.com:authelia/pam.git","description":"Authelia PAM (Pluggable Authentication Module)","default_branch":"master","json_path":"/authelia/pam.json","path":"/authelia/pam","settings_path":"/authelia/pam/settings","builds_path":"https://buildkite.com/authelia/pam/builds","builds_count":57,"scheduled_builds_path":"/authelia/pam/builds?state=scheduled","scheduled_builds_count":0,"running_builds_path":"/authelia/pam/builds?state=running","running_builds_count":0,"permissions":{"edit":{"allowed":false,"reason":"anonymous","message":"You must be signed in to change this pipeline"},"trigger_build":{"allowed":false,"reason":"anonymous","message":"You must be signed in to trigger a build in this pipeline"},"favorite_project":{"allowed":false,"reason":"anonymous","message":"You must be signed in to favorite this pipeline"}}},"pipelineSettings":null,"builds":[{"id":"019e15d8-3872-4520-b9b8-e1cf25e6c81e","number":41,"message":"ci(buildkite): allow manual retry on build and add hook for releases (#6) Signed-off-by: Amir Zarrinkafsh <3339418+nightah@users.noreply.github.com>","state":"passed","blocked_state":null,"path":"/authelia/pam/builds/41","commit_id":"8c708950c1706e774ea1e5f36b00460ad8dc8c6a","commit_short_length":7,"commit_url":"https://github.com/authelia/pam/commit/8c708950c1706e774ea1e5f36b00460ad8dc8c6a","author_name":"Amir Zarrinkafsh","author_avatar":"https://avatars.githubusercontent.com/u/3339418?v=4","branch_name":"master","branch_path":"/authelia/pam/builds?branch=master","github_workflow_name":null,"github_workflow_path":null,"github_workflow_url":null,"github_workflow_event_description":null,"created_at":"2026-05-11T07:02:32.318Z","scheduled_at":"2026-05-11T07:02:32.344Z","started_at":"2026-05-11T07:02:33.163Z","canceled_at":null,"finished_at":"2026-05-11T07:03:13.446Z","cancel_reason":null,"project":{"provider":{"frontend_icon":"github"}},"merge_queue_base_branch":null,"merge_queue_path":"/authelia/pam/builds"},{"id":"019e15d9-a3cb-442a-99b6-134ca34fd688","number":42,"message":"ci(buildkite): allow manual retry on build and add hook for releases (#6) Signed-off-by: Amir Zarrinkafsh <3339418+nightah@users.noreply.github.com>","state":"passed","blocked_state":null,"path":"/authelia/pam/builds/42","commit_id":"8c708950c1706e774ea1e5f36b00460ad8dc8c6a","commit_short_length":7,"commit_url":"https://github.com/authelia/pam/commit/8c708950c1706e774ea1e5f36b00460ad8dc8c6a","author_name":"Amir Zarrinkafsh","author_avatar":"https://buildkiteusercontent.com/assets/7eb28a38-066b-418b-95c5-b5c7fb78c6bc/3339418.jpg","branch_name":"v0.1.1","branch_path":"/authelia/pam/builds?branch=v0.1.1","github_workflow_name":null,"github_workflow_path":null,"github_workflow_url":null,"github_workflow_event_description":null,"created_at":"2026-05-11T07:04:05.335Z","scheduled_at":"2026-05-11T07:04:05.357Z","started_at":"2026-05-11T07:04:06.267Z","canceled_at":null,"finished_at":"2026-05-11T07:05:39.618Z","cancel_reason":null,"project":{"provider":{"frontend_icon":"github"}},"merge_queue_base_branch":null,"merge_queue_path":"/authelia/pam/builds"},{"id":"019e15c6-f581-4d19-9a76-c0c39f69e051","number":38,"message":"fix(goreleaser): install pam module to debian multiarch path (#5) The previous destination `/lib/security/pam_authelia.so` is the legacy non-multiarch path. Since the multiarch transition (and now usrmerge), Debian and Ubuntu ship PAM modules under `/usr/lib//security/`. Verified against `libpam-abl` 0.6.0-7.1 on Launchpad, which installs `pam_abl.so` at `/usr/lib/x86_64-linux-gnu/security/`. GoReleaser does not expose the Debian architecture triplet as a template variable, so per-arch `overrides` set the correct destination for each goarch (`amd64`, `arm64`, `arm`/armhf). Permissions remain `0644`, matching libpam packaging conventions. Signed-off-by: Amir Zarrinkafsh <3339418+nightah@users.noreply.github.com>","state":"failed","blocked_state":null,"path":"/authelia/pam/builds/38","commit_id":"7ec0f5cb9f0d485dd8725ba45efbe4d85992cf45","commit_short_length":7,"commit_url":"https://github.com/authelia/pam/commit/7ec0f5cb9f0d485dd8725ba45efbe4d85992cf45","author_name":"Amir Zarrinkafsh","author_avatar":"https://buildkiteusercontent.com/assets/7eb28a38-066b-418b-95c5-b5c7fb78c6bc/3339418.jpg","branch_name":"v0.1.1","branch_path":"/authelia/pam/builds?branch=v0.1.1","github_workflow_name":null,"github_workflow_path":null,"github_workflow_url":null,"github_workflow_event_description":null,"created_at":"2026-05-11T06:43:41.077Z","scheduled_at":"2026-05-11T06:43:41.104Z","started_at":"2026-05-11T06:43:41.974Z","canceled_at":null,"finished_at":"2026-05-11T06:45:39.883Z","cancel_reason":null,"project":{"provider":{"frontend_icon":"github"}},"merge_queue_base_branch":null,"merge_queue_path":"/authelia/pam/builds"},{"id":"019e1a0e-c948-4abb-b7a0-894b4f93ca1c","number":45,"message":"fix(goreleaser): include pam_authelia.so in deb packages (#7) The per-architecture `overrides` block added in 7ec0f5c misused GoReleaser's nfpm API: the keys of `nfpms.overrides` are packager formats (`deb`, `rpm`, `apk`, etc.), not goarch values. As a result the `amd64`, `arm64`, and `arm` keys were silently ignored, the base config had no `contents:`, and every `.deb` shipped with only the Go helper at `./usr/bin/pam_authelia`; `pam_authelia.so` was missing entirely. Replace the broken override block with a single top-level `contents:` entry that templates the Debian multiarch triplet into `dst` via a `{{ if eq .Arch ... }}` conditional. GoReleaser still expands `dst` per goarch, so each `.deb` lands the module at the correct path (`/usr/lib/x86_64-linux-gnu/security/`, `/usr/lib/aarch64-linux-gnu/security/`, `/usr/lib/arm-linux-gnueabihf/security/`) without needing a built-in triplet variable. Verified locally by running `goreleaser release --snapshot` with stub `.so` files and inspecting each `.deb` with `dpkg-deb -c`. Signed-off-by: Amir Zarrinkafsh <3339418+nightah@users.noreply.github.com>","state":"passed","blocked_state":null,"path":"/authelia/pam/builds/45","commit_id":"30432ec60fc07e96a919b49c35d06ba89390efa3","commit_short_length":7,"commit_url":"https://github.com/authelia/pam/commit/30432ec60fc07e96a919b49c35d06ba89390efa3","author_name":"Amir Zarrinkafsh","author_avatar":"https://avatars.githubusercontent.com/u/3339418?v=4","branch_name":"master","branch_path":"/authelia/pam/builds?branch=master","github_workflow_name":null,"github_workflow_path":null,"github_workflow_url":null,"github_workflow_event_description":null,"created_at":"2026-05-12T02:40:37.204Z","scheduled_at":"2026-05-12T02:40:37.252Z","started_at":"2026-05-12T02:40:38.549Z","canceled_at":null,"finished_at":"2026-05-12T02:41:26.653Z","cancel_reason":null,"project":{"provider":{"frontend_icon":"github"}},"merge_queue_base_branch":null,"merge_queue_path":"/authelia/pam/builds"},{"id":"019e1a5f-36df-4bf1-984d-145d945dd071","number":49,"message":"ci(buildkite): sign and verify apt deploy commit (#8) The git commit that publishes the apt repository update was previously unsigned, even though the `Release.gpg` and `InRelease` files it contains are GPG-signed with `security@authelia.com`. Sign the commit with the same key so the deploy is verifiable end-to-end. The apt `Release` signing on the preceding lines populates `gpg-agent`'s passphrase cache for `security@authelia.com` via `--pinentry-mode loopback --passphrase`, so `git commit -S` a few lines later hits the cache and signs non-interactively without a wrapper, temp file, or duplicated passphrase plumbing. Add `git verify-commit HEAD` as a gate before `git push` so a bad signature aborts the deploy rather than publishing an unverifiable commit. Validated on Buildkite nodes with the production key: `git verify-commit` exits zero, `%G?` returns `G` (good signature), `%GS` resolves to the `security@authelia.com` UID, and the author/committer remain `autheliabot`. Signed-off-by: Amir Zarrinkafsh <3339418+nightah@users.noreply.github.com>","state":"passed","blocked_state":null,"path":"/authelia/pam/builds/49","commit_id":"df0987488b0ab36cc4bb1a37225bbcf9eb1d0d1a","commit_short_length":7,"commit_url":"https://github.com/authelia/pam/commit/df0987488b0ab36cc4bb1a37225bbcf9eb1d0d1a","author_name":"Amir Zarrinkafsh","author_avatar":"https://avatars.githubusercontent.com/u/3339418?v=4","branch_name":"master","branch_path":"/authelia/pam/builds?branch=master","github_workflow_name":null,"github_workflow_path":null,"github_workflow_url":null,"github_workflow_event_description":null,"created_at":"2026-05-12T04:08:28.135Z","scheduled_at":"2026-05-12T04:08:28.159Z","started_at":"2026-05-12T04:08:29.170Z","canceled_at":null,"finished_at":"2026-05-12T04:09:18.364Z","cancel_reason":null,"project":{"provider":{"frontend_icon":"github"}},"merge_queue_base_branch":null,"merge_queue_path":"/authelia/pam/builds"},{"id":"01a0efa2-6f54-41a9-9e45-b98e388f6df1","number":55,"message":"ci: align renovate and crossbuild with authelia/authelia (#12) Return Renovate to its default `renovate/` branch prefix. `branchPrefix` was set to `renovate-` only because `renovate/` could not be used verbatim as a container tag. That constraint never applied here, since this repository publishes no images and no branch name is turned into a tag or file name, and authelia/authelia has since dropped the override in authelia/authelia#13249. `branchPrefixOld` retires the branches left on the old prefix, and the draft bypass in `.buildkite/pipeline.sh` matches `^(dependabot|renovate)` and so covers both. Take the Go toolchain, headers, goreleaser, grype and syft mounted into `authelia/crossbuild` from `/buildkite/.tools` rather than `/usr`, and drop the fixed `pam-authelia-crossbuild` container name, matching authelia/authelia#12726. On a Docker daemon shared between the agents on a host, bind mount sources are resolved against the host rather than inside the agent that requested them, so the agent image's own `/usr` is not visible there, and a fixed name collides whenever two builds run on the same host at once. The `unit-test` agents this step targets are the same ones authelia/authelia already builds on with these paths, so `/buildkite/.tools` is in place on them today. Signed-off-by: Amir Zarrinkafsh <3339418+nightah@users.noreply.github.com>","state":"passed","blocked_state":null,"path":"/authelia/pam/builds/55","commit_id":"cacea0a1de8e72f86e520ea74a12ceb2c7c81d4a","commit_short_length":7,"commit_url":"https://github.com/authelia/pam/commit/cacea0a1de8e72f86e520ea74a12ceb2c7c81d4a","author_name":"Amir Zarrinkafsh","author_avatar":"https://avatars.githubusercontent.com/u/3339418?v=4","branch_name":"master","branch_path":"/authelia/pam/builds?branch=master","github_workflow_name":null,"github_workflow_path":null,"github_workflow_url":null,"github_workflow_event_description":null,"created_at":"2026-09-30T00:06:35.097Z","scheduled_at":"2026-09-30T00:06:35.142Z","started_at":"2026-09-30T00:06:36.127Z","canceled_at":null,"finished_at":"2026-09-30T00:07:30.781Z","cancel_reason":null,"project":{"provider":{"frontend_icon":"github"}},"merge_queue_base_branch":null,"merge_queue_path":"/authelia/pam/builds"},{"id":"01a0efa2-f4b8-4743-a430-1ae4517efc1e","number":57,"message":"docs(readme): restyle badges into three rows (#11) Replace the single row of flat-square shields.io badges with the three centred rows of shieldcn outline badges used by authelia/authelia and authelia/baseimage, with light and dark variants. The first row covers project state (Buildkite build and licence), the second covers distribution (GitHub release plus the `pam_authelia`, `pam_authelia-bin` and `pam_authelia-git` AUR packages published from Buildkite), and the third keeps the Discord and Matrix community links. Drop the now-unused `[Apache 2.0]` link reference. Signed-off-by: Amir Zarrinkafsh <3339418+nightah@users.noreply.github.com>","state":"passed","blocked_state":null,"path":"/authelia/pam/builds/57","commit_id":"a4e709ca94579875a05400c353ce99973bdad91a","commit_short_length":7,"commit_url":"https://github.com/authelia/pam/commit/a4e709ca94579875a05400c353ce99973bdad91a","author_name":"Amir Zarrinkafsh","author_avatar":"https://avatars.githubusercontent.com/u/3339418?v=4","branch_name":"master","branch_path":"/authelia/pam/builds?branch=master","github_workflow_name":null,"github_workflow_path":null,"github_workflow_url":null,"github_workflow_event_description":null,"created_at":"2026-09-30T00:07:09.247Z","scheduled_at":"2026-09-30T00:07:09.279Z","started_at":"2026-09-30T00:07:10.141Z","canceled_at":null,"finished_at":"2026-09-30T00:07:32.543Z","cancel_reason":null,"project":{"provider":{"frontend_icon":"github"}},"merge_queue_base_branch":null,"merge_queue_path":"/authelia/pam/builds"},{"id":"019e1401-11d3-4b7b-a123-d95672df11d4","number":25,"message":"feat: pam_authelia intial commit (#1) * feat: pam_authelia intial commit Introduces pam_authelia, a PAM module that delegates Linux host authentication to an Authelia server. The module is split into a small C shim loaded by sshd/sudo/login and a Go helper that owns the HTTPS client, OAuth2 flows, and prompt rendering, communicating over a stdin/stdout pipe protocol driven by the shim's PAM conversation function. Supports first-factor password authentication plus second-factor flows via TOTP, Duo Push, and the OAuth2 RFC 8628 device authorization grant. The device flow renders a scannable QR code directly in the terminal, delivered through the RFC 4256 prompt field so it survives BSD ssh clients' vis(3) sanitization. Auth level, method preference order, and OAuth2 client credentials are all configurable via PAM module options. Ships with a GoReleaser pipeline that produces multi-arch tarballs and Debian packages for linux-amd64/arm/arm64 across glibc and musl, with GPG-signed checksums and CycloneDX/SPDX SBOMs per archive. Repo wiring includes golangci-lint, yamllint, lefthook (pre-commit linters and a Conventional Commits commit-msg hook), Renovate covering Go modules and GitHub Actions, CodeQL, SLSA provenance for tagged releases, and a Buildkite pipeline mirroring authelia/authelia's release flow. * ci(buildkite): fix path for pipline steps * ci(buildkite): fix go test path * refactor(shim): vendor pam headers * refactor(shim): musl fortify support Signed-off-by: Amir Zarrinkafsh <3339418+nightah@users.noreply.github.com> * ci(buildkite): refactor artifact uploads Signed-off-by: Amir Zarrinkafsh <3339418+nightah@users.noreply.github.com> * refactor(shim): prevent polling authelia on client disconnect Signed-off-by: Amir Zarrinkafsh <3339418+nightah@users.noreply.github.com> * ci: remove dead yamllint ignores and adjust slsa sleep timers Signed-off-by: Amir Zarrinkafsh <3339418+nightah@users.noreply.github.com> * ci(buildkite): apt releaser for pam_authelia Signed-off-by: Amir Zarrinkafsh <3339418+nightah@users.noreply.github.com> * refactor: fix device authorization flow Signed-off-by: Amir Zarrinkafsh <3339418+nightah@users.noreply.github.com> * refactor: code suggestions and refactor comments/usa english Signed-off-by: Amir Zarrinkafsh <3339418+nightah@users.noreply.github.com> * refactor: suggestions pascal case test names Signed-off-by: Amir Zarrinkafsh <3339418+nightah@users.noreply.github.com> * refactor(shim): unify pam conv response cleanup Signed-off-by: Amir Zarrinkafsh <3339418+nightah@users.noreply.github.com> --------- Signed-off-by: Amir Zarrinkafsh <3339418+nightah@users.noreply.github.com> Co-authored-by: James Elliott ","state":"passed","blocked_state":null,"path":"/authelia/pam/builds/25","commit_id":"657d79bbaf22f4f6a5daaefd37a2b1891e0c5d37","commit_short_length":7,"commit_url":"https://github.com/authelia/pam/commit/657d79bbaf22f4f6a5daaefd37a2b1891e0c5d37","author_name":"Amir Zarrinkafsh","author_avatar":"https://buildkiteusercontent.com/assets/7eb28a38-066b-418b-95c5-b5c7fb78c6bc/3339418.jpg","branch_name":"v0.1.0","branch_path":"/authelia/pam/builds?branch=v0.1.0","github_workflow_name":null,"github_workflow_path":null,"github_workflow_url":null,"github_workflow_event_description":null,"created_at":"2026-05-10T22:27:54.976Z","scheduled_at":"2026-05-10T22:27:55.000Z","started_at":"2026-05-10T23:07:24.054Z","canceled_at":null,"finished_at":"2026-05-10T23:10:26.542Z","cancel_reason":null,"project":{"provider":{"frontend_icon":"github"}},"merge_queue_base_branch":null,"merge_queue_path":"/authelia/pam/builds"},{"id":"019e1a0f-89d0-40b0-b7eb-99495a9f187a","number":46,"message":"fix(goreleaser): include pam_authelia.so in deb packages (#7) The per-architecture `overrides` block added in 7ec0f5c misused GoReleaser's nfpm API: the keys of `nfpms.overrides` are packager formats (`deb`, `rpm`, `apk`, etc.), not goarch values. As a result the `amd64`, `arm64`, and `arm` keys were silently ignored, the base config had no `contents:`, and every `.deb` shipped with only the Go helper at `./usr/bin/pam_authelia`; `pam_authelia.so` was missing entirely. Replace the broken override block with a single top-level `contents:` entry that templates the Debian multiarch triplet into `dst` via a `{{ if eq .Arch ... }}` conditional. GoReleaser still expands `dst` per goarch, so each `.deb` lands the module at the correct path (`/usr/lib/x86_64-linux-gnu/security/`, `/usr/lib/aarch64-linux-gnu/security/`, `/usr/lib/arm-linux-gnueabihf/security/`) without needing a built-in triplet variable. Verified locally by running `goreleaser release --snapshot` with stub `.so` files and inspecting each `.deb` with `dpkg-deb -c`. Signed-off-by: Amir Zarrinkafsh <3339418+nightah@users.noreply.github.com>","state":"passed","blocked_state":null,"path":"/authelia/pam/builds/46","commit_id":"30432ec60fc07e96a919b49c35d06ba89390efa3","commit_short_length":7,"commit_url":"https://github.com/authelia/pam/commit/30432ec60fc07e96a919b49c35d06ba89390efa3","author_name":"Amir Zarrinkafsh","author_avatar":"https://buildkiteusercontent.com/assets/7eb28a38-066b-418b-95c5-b5c7fb78c6bc/3339418.jpg","branch_name":"v0.1.2","branch_path":"/authelia/pam/builds?branch=v0.1.2","github_workflow_name":null,"github_workflow_path":null,"github_workflow_url":null,"github_workflow_event_description":null,"created_at":"2026-05-12T02:41:26.491Z","scheduled_at":"2026-05-12T02:41:26.519Z","started_at":"2026-05-12T02:41:27.590Z","canceled_at":null,"finished_at":"2026-05-12T02:43:57.199Z","cancel_reason":null,"project":{"provider":{"frontend_icon":"github"}},"merge_queue_base_branch":null,"merge_queue_path":"/authelia/pam/builds"},{"id":"01a0efa1-ee5c-463d-b25d-246803cd14d9","number":53,"message":"ci: align renovate and crossbuild with authelia/authelia (#12) Return Renovate to its default `renovate/` branch prefix. `branchPrefix` was set to `renovate-` only because `renovate/` could not be used verbatim as a container tag. That constraint never applied here, since this repository publishes no images and no branch name is turned into a tag or file name, and authelia/authelia has since dropped the override in authelia/authelia#13249. `branchPrefixOld` retires the branches left on the old prefix, and the draft bypass in `.buildkite/pipeline.sh` matches `^(dependabot|renovate)` and so covers both. Take the Go toolchain, headers, goreleaser, grype and syft mounted into `authelia/crossbuild` from `/buildkite/.tools` rather than `/usr`, and drop the fixed `pam-authelia-crossbuild` container name, matching authelia/authelia#12726. On a Docker daemon shared between the agents on a host, bind mount sources are resolved against the host rather than inside the agent that requested them, so the agent image's own `/usr` is not visible there, and a fixed name collides whenever two builds run on the same host at once. The `unit-test` agents this step targets are the same ones authelia/authelia already builds on with these paths, so `/buildkite/.tools` is in place on them today. Signed-off-by: Amir Zarrinkafsh <3339418+nightah@users.noreply.github.com>","state":"passed","blocked_state":null,"path":"/authelia/pam/builds/53","commit_id":"cacea0a1de8e72f86e520ea74a12ceb2c7c81d4a","commit_short_length":7,"commit_url":"https://github.com/authelia/pam/commit/cacea0a1de8e72f86e520ea74a12ceb2c7c81d4a","author_name":"Amir Zarrinkafsh","author_avatar":"https://buildkiteusercontent.com/assets/7eb28a38-066b-418b-95c5-b5c7fb78c6bc/3339418.jpg","branch_name":"gh-readonly-queue/master/pr-12-df0987488b0ab36cc4bb1a37225bbcf9eb1d0d1a","branch_path":"/authelia/pam/builds?branch=gh-readonly-queue%2Fmaster%2Fpr-12-df0987488b0ab36cc4bb1a37225bbcf9eb1d0d1a","github_workflow_name":null,"github_workflow_path":null,"github_workflow_url":null,"github_workflow_event_description":null,"created_at":"2026-09-30T00:06:02.082Z","scheduled_at":"2026-09-30T00:06:02.191Z","started_at":"2026-09-30T00:06:03.128Z","canceled_at":null,"finished_at":"2026-09-30T00:06:25.252Z","cancel_reason":null,"project":{"provider":{"frontend_icon":"github"}},"merge_queue_base_branch":"master","merge_queue_path":"/authelia/pam/builds?merge_queue=master"},{"id":"019e1a0e-4c70-4634-bd4b-fa3b1c1fb995","number":44,"message":"fix(goreleaser): include pam_authelia.so in deb packages (#7) The per-architecture `overrides` block added in 7ec0f5c misused GoReleaser's nfpm API: the keys of `nfpms.overrides` are packager formats (`deb`, `rpm`, `apk`, etc.), not goarch values. As a result the `amd64`, `arm64`, and `arm` keys were silently ignored, the base config had no `contents:`, and every `.deb` shipped with only the Go helper at `./usr/bin/pam_authelia`; `pam_authelia.so` was missing entirely. Replace the broken override block with a single top-level `contents:` entry that templates the Debian multiarch triplet into `dst` via a `{{ if eq .Arch ... }}` conditional. GoReleaser still expands `dst` per goarch, so each `.deb` lands the module at the correct path (`/usr/lib/x86_64-linux-gnu/security/`, `/usr/lib/aarch64-linux-gnu/security/`, `/usr/lib/arm-linux-gnueabihf/security/`) without needing a built-in triplet variable. Verified locally by running `goreleaser release --snapshot` with stub `.so` files and inspecting each `.deb` with `dpkg-deb -c`. Signed-off-by: Amir Zarrinkafsh <3339418+nightah@users.noreply.github.com>","state":"passed","blocked_state":null,"path":"/authelia/pam/builds/44","commit_id":"30432ec60fc07e96a919b49c35d06ba89390efa3","commit_short_length":7,"commit_url":"https://github.com/authelia/pam/commit/30432ec60fc07e96a919b49c35d06ba89390efa3","author_name":"Amir Zarrinkafsh","author_avatar":"https://buildkiteusercontent.com/assets/7eb28a38-066b-418b-95c5-b5c7fb78c6bc/3339418.jpg","branch_name":"gh-readonly-queue/master/pr-7-8c708950c1706e774ea1e5f36b00460ad8dc8c6a","branch_path":"/authelia/pam/builds?branch=gh-readonly-queue%2Fmaster%2Fpr-7-8c708950c1706e774ea1e5f36b00460ad8dc8c6a","github_workflow_name":null,"github_workflow_path":null,"github_workflow_url":null,"github_workflow_event_description":null,"created_at":"2026-05-12T02:40:05.259Z","scheduled_at":"2026-05-12T02:40:05.306Z","started_at":"2026-05-12T02:40:06.356Z","canceled_at":null,"finished_at":"2026-05-12T02:40:26.299Z","cancel_reason":null,"project":{"provider":{"frontend_icon":"github"}},"merge_queue_base_branch":"master","merge_queue_path":"/authelia/pam/builds?merge_queue=master"},{"id":"01a0efa2-735b-4766-a556-9f13f4ebe146","number":56,"message":"docs(readme): restyle badges into three rows (#11) Replace the single row of flat-square shields.io badges with the three centred rows of shieldcn outline badges used by authelia/authelia and authelia/baseimage, with light and dark variants. The first row covers project state (Buildkite build and licence), the second covers distribution (GitHub release plus the `pam_authelia`, `pam_authelia-bin` and `pam_authelia-git` AUR packages published from Buildkite), and the third keeps the Discord and Matrix community links. Drop the now-unused `[Apache 2.0]` link reference. Signed-off-by: Amir Zarrinkafsh <3339418+nightah@users.noreply.github.com>","state":"passed","blocked_state":null,"path":"/authelia/pam/builds/56","commit_id":"a4e709ca94579875a05400c353ce99973bdad91a","commit_short_length":7,"commit_url":"https://github.com/authelia/pam/commit/a4e709ca94579875a05400c353ce99973bdad91a","author_name":"Amir Zarrinkafsh","author_avatar":"https://buildkiteusercontent.com/assets/7eb28a38-066b-418b-95c5-b5c7fb78c6bc/3339418.jpg","branch_name":"gh-readonly-queue/master/pr-11-cacea0a1de8e72f86e520ea74a12ceb2c7c81d4a","branch_path":"/authelia/pam/builds?branch=gh-readonly-queue%2Fmaster%2Fpr-11-cacea0a1de8e72f86e520ea74a12ceb2c7c81d4a","github_workflow_name":null,"github_workflow_path":null,"github_workflow_url":null,"github_workflow_event_description":null,"created_at":"2026-09-30T00:06:36.128Z","scheduled_at":"2026-09-30T00:06:36.184Z","started_at":"2026-09-30T00:06:37.186Z","canceled_at":null,"finished_at":"2026-09-30T00:07:00.271Z","cancel_reason":null,"project":{"provider":{"frontend_icon":"github"}},"merge_queue_base_branch":"master","merge_queue_path":"/authelia/pam/builds?merge_queue=master"},{"id":"019e15d7-b481-4193-b189-724bd8c3d35e","number":40,"message":"ci(buildkite): allow manual retry on build and add hook for releases (#6) Signed-off-by: Amir Zarrinkafsh <3339418+nightah@users.noreply.github.com>","state":"passed","blocked_state":null,"path":"/authelia/pam/builds/40","commit_id":"8c708950c1706e774ea1e5f36b00460ad8dc8c6a","commit_short_length":7,"commit_url":"https://github.com/authelia/pam/commit/8c708950c1706e774ea1e5f36b00460ad8dc8c6a","author_name":"Amir Zarrinkafsh","author_avatar":"https://buildkiteusercontent.com/assets/7eb28a38-066b-418b-95c5-b5c7fb78c6bc/3339418.jpg","branch_name":"gh-readonly-queue/master/pr-6-7ec0f5cb9f0d485dd8725ba45efbe4d85992cf45","branch_path":"/authelia/pam/builds?branch=gh-readonly-queue%2Fmaster%2Fpr-6-7ec0f5cb9f0d485dd8725ba45efbe4d85992cf45","github_workflow_name":null,"github_workflow_path":null,"github_workflow_url":null,"github_workflow_event_description":null,"created_at":"2026-05-11T07:01:58.539Z","scheduled_at":"2026-05-11T07:01:58.559Z","started_at":"2026-05-11T07:01:59.458Z","canceled_at":null,"finished_at":"2026-05-11T07:02:16.419Z","cancel_reason":null,"project":{"provider":{"frontend_icon":"github"}},"merge_queue_base_branch":"master","merge_queue_path":"/authelia/pam/builds?merge_queue=master"},{"id":"019e1a5e-b708-4fda-9803-25cdc72793be","number":48,"message":"ci(buildkite): sign and verify apt deploy commit (#8) The git commit that publishes the apt repository update was previously unsigned, even though the `Release.gpg` and `InRelease` files it contains are GPG-signed with `security@authelia.com`. Sign the commit with the same key so the deploy is verifiable end-to-end. The apt `Release` signing on the preceding lines populates `gpg-agent`'s passphrase cache for `security@authelia.com` via `--pinentry-mode loopback --passphrase`, so `git commit -S` a few lines later hits the cache and signs non-interactively without a wrapper, temp file, or duplicated passphrase plumbing. Add `git verify-commit HEAD` as a gate before `git push` so a bad signature aborts the deploy rather than publishing an unverifiable commit. Validated on Buildkite nodes with the production key: `git verify-commit` exits zero, `%G?` returns `G` (good signature), `%GS` resolves to the `security@authelia.com` UID, and the author/committer remain `autheliabot`. Signed-off-by: Amir Zarrinkafsh <3339418+nightah@users.noreply.github.com>","state":"passed","blocked_state":null,"path":"/authelia/pam/builds/48","commit_id":"df0987488b0ab36cc4bb1a37225bbcf9eb1d0d1a","commit_short_length":7,"commit_url":"https://github.com/authelia/pam/commit/df0987488b0ab36cc4bb1a37225bbcf9eb1d0d1a","author_name":"Clément Michaud","author_avatar":"https://www.gravatar.com/avatar/f5d6ba1e6a72e8cb8ec778073c50766f?d=https%3A%2F%2Fbuildkiteassets.com%2Fassets%2Favatar_default-36daddedfee40832d390d7e77525648a937db77aa9044d5d50432c2ef95337e6.png","branch_name":"gh-readonly-queue/master/pr-8-30432ec60fc07e96a919b49c35d06ba89390efa3","branch_path":"/authelia/pam/builds?branch=gh-readonly-queue%2Fmaster%2Fpr-8-30432ec60fc07e96a919b49c35d06ba89390efa3","github_workflow_name":null,"github_workflow_path":null,"github_workflow_url":null,"github_workflow_event_description":null,"created_at":"2026-05-12T04:07:55.412Z","scheduled_at":"2026-05-12T04:07:55.435Z","started_at":"2026-05-12T04:07:56.435Z","canceled_at":null,"finished_at":"2026-05-12T04:08:19.173Z","cancel_reason":null,"project":{"provider":{"frontend_icon":"github"}},"merge_queue_base_branch":"master","merge_queue_path":"/authelia/pam/builds?merge_queue=master"}]}