deploy script, use kms

Signed-off-by: Jason Hall <jason@chainguard.dev>

deploy.sh

@@ -0,0 +1,48 @@
+#!/usr/bin/env bash
+
+set -e
+
+# TODO(jason): Make this Terraform.
+
+PROJECT=$(gcloud config get-value project)
+REGION=us-east4
+SA_NAME=webpush
+SA_EMAIL="$SA_NAME@$PROJECT.iam.gserviceaccount.com"
+
+# Create service account
+gcloud iam service-accounts create $SA_NAME \
+  --display-name="Web Push Service Account" 2>/dev/null || echo "Service account already exists"
+
+gcloud kms keyrings create webpush-vapid-key \
+  --location=global 2>/dev/null || echo "Keyring already exists"
+
+gcloud kms keys create vapid-key \
+  --location=global \
+  --keyring=webpush-vapid-key \
+  --purpose=asymmetric-signing \
+  --default-algorithm=ec-sign-p256-sha256 2>/dev/null || echo "KMS key already exists"
+
+echo "Granting KMS permissions to $SA_EMAIL"
+
+# Grant permissions
+gcloud kms keys add-iam-policy-binding vapid-key \
+  --location=global \
+  --keyring=webpush-vapid-key \
+  --member="serviceAccount:$SA_EMAIL" \
+  --role="roles/cloudkms.signer"
+
+gcloud kms keys add-iam-policy-binding vapid-key \
+  --location=global \
+  --keyring=webpush-vapid-key \
+  --member="serviceAccount:$SA_EMAIL" \
+  --role="roles/cloudkms.publicKeyViewer"
+
+# Deploy with the service account
+gcloud run deploy webpush \
+  --image $(KO_DOCKER_REPO=gcr.io/$PROJECT/webpush ko build ./example --sbom=none) \
+  --service-account=$SA_EMAIL \
+  --set-env-vars KMS_KEY_NAME=projects/$PROJECT/locations/global/keyRings/webpush-vapid-key/cryptoKeys/vapid-key/cryptoKeyVersions/1 \
+  --region $REGION --allow-unauthenticated \
+  --memory 4Gi --cpu 2
+
+echo "Deployment complete!"

example/main.go

@@ -11,27 +11,29 @@ package main
 import (
 	"context"
 	"embed"
+	"encoding/base64"
 	"encoding/json"
 	"io/fs"
-	"log"
 	"net/http"
 	"os"
 	"strings"
-	"sync"
 	"time"
 
+	"github.com/chainguard-dev/clog"
+	_ "github.com/chainguard-dev/clog/gcp/init"
 	"github.com/google/uuid"
 	"github.com/imjasonh/webpush"
 	"github.com/imjasonh/webpush/keys"
 	"github.com/imjasonh/webpush/storage"
+	"github.com/sethvargo/go-envconfig"
 )
 
 //go:embed static/*
 var staticFiles embed.FS
 
 const (
-	keyPath   = "vapid-private.pem"
+	keyPath   = "/tmp/vapid-private.pem"
-	dbPath    = "subscriptions.db"
+	dbPath    = "/tmp/subscriptions.db"
 	subject   = "mailto:admin@example.com"
 	serverURL = "http://localhost:8080"
 )
@@ -39,38 +41,46 @@ const (
 var (
 	store  storage.Storage
 	client *webpush.Client
-	signer *keys.FileSigner
+	signer webpush.Signer
-	mu     sync.RWMutex
 )
 
+var env = envconfig.MustProcess(context.Background(), &struct {
+	KMSKeyName string `env:"KMS_KEY_NAME" default:""`
+}{})
+
 func main() {
+	ctx := context.Background()
 	var err error
 
 	// Initialize or load VAPID keys
-	if _, err := os.Stat(keyPath); os.IsNotExist(err) {
+	if env.KMSKeyName != "" {
-		log.Println("Generating new VAPID keys...")
+		clog.Infof("Using KMS for VAPID keys: %s", env.KMSKeyName)
+		signer, err = keys.NewKMSSigner(ctx, env.KMSKeyName)
+		if err != nil {
+			clog.Fatalf("Failed to initialize KMS signer: %v", err)
+		}
+	} else if _, err := os.Stat(keyPath); os.IsNotExist(err) {
+		clog.Info("Generating new VAPID keys...")
 		signer, err = keys.GenerateKey(keyPath)
 		if err != nil {
-			log.Fatalf("Failed to generate keys: %v", err)
+			clog.Fatalf("Failed to generate keys: %v", err)
 		}
-		log.Println("VAPID keys generated and saved to", keyPath)
+		clog.Info("VAPID keys generated and saved to", keyPath)
 	} else {
 		signer, err = keys.NewFileSigner(keyPath)
 		if err != nil {
-			log.Fatalf("Failed to load keys: %v", err)
+			clog.Fatalf("Failed to load keys: %v", err)
 		}
-		log.Println("VAPID keys loaded from", keyPath)
+		clog.Info("VAPID keys loaded from", keyPath)
 	}
 
-	log.Println("VAPID Public Key:", signer.PublicKeyBase64())
-
 	// Initialize SQLite storage
 	store, err = storage.NewSQLite(dbPath)
 	if err != nil {
-		log.Fatalf("Failed to initialize storage: %v", err)
+		clog.Fatalf("Failed to initialize storage: %v", err)
 	}
 	defer store.Close()
-	log.Println("SQLite storage initialized at", dbPath)
+	clog.Info("SQLite storage initialized at", dbPath)
 
 	// Create web push client
 	client = webpush.NewClient(signer, subject)
@@ -81,7 +91,7 @@ func main() {
 	// Set up HTTP handlers
 	staticFS, err := fs.Sub(staticFiles, "static")
 	if err != nil {
-		log.Fatalf("Failed to create static file system: %v", err)
+		clog.Fatalf("Failed to create static file system: %v", err)
 	}
 	http.Handle("/", http.FileServer(http.FS(staticFS)))
 	http.HandleFunc("/api/vapid-public-key", handleVAPIDPublicKey)
@@ -89,10 +99,10 @@ func main() {
 	http.HandleFunc("/api/unsubscribe", handleUnsubscribe)
 	http.HandleFunc("/ping", handlePing)
 
-	log.Printf("Server starting at %s", serverURL)
+	clog.Infof("Server starting at %s", serverURL)
-	log.Printf("Visit %s to subscribe to push notifications", serverURL)
+	clog.Infof("Visit %s to subscribe to push notifications", serverURL)
 	if err := http.ListenAndServe(":8080", nil); err != nil {
-		log.Fatalf("Server failed: %v", err)
+		clog.Fatalf("Server failed: %v", err)
 	}
 }
 
@@ -112,12 +122,12 @@ func sendToAll(title, body string) {
 
 	records, err := store.List(ctx, 1000, 0)
 	if err != nil {
-		log.Printf("Failed to list subscriptions: %v", err)
+		clog.Infof("Failed to list subscriptions: %v", err)
 		return
 	}
 
 	if len(records) == 0 {
-		log.Println("No subscribers to notify")
+		clog.Info("No subscribers to notify")
 		return
 	}
 
@@ -126,7 +136,7 @@ func sendToAll(title, body string) {
 		"body":  body,
 	})
 	if err != nil {
-		log.Printf("Failed to marshal payload: %v", err)
+		clog.Infof("Failed to marshal payload: %v", err)
 		return
 	}
 
@@ -137,14 +147,14 @@ func sendToAll(title, body string) {
 			Urgency: "normal",
 		})
 		if err != nil {
-			log.Printf("Failed to send to %s: %v", record.ID, err)
+			clog.Infof("Failed to send to %s: %v", record.ID, err)
 			failed++
 			// Clean up expired/invalid subscriptions (410 Gone)
 			if isGone(err) {
 				if delErr := store.Delete(ctx, record.ID); delErr != nil {
-					log.Printf("Failed to delete expired subscription: %v", delErr)
+					clog.Infof("Failed to delete expired subscription: %v", delErr)
 				} else {
-					log.Printf("Deleted expired subscription: %s", record.ID)
+					clog.Infof("Deleted expired subscription: %s", record.ID)
 				}
 			}
 		} else {
@@ -152,7 +162,7 @@ func sendToAll(title, body string) {
 		}
 	}
 
-	log.Printf("Push sent: %d successful, %d failed", sent, failed)
+	clog.Infof("Push sent: %d successful, %d failed", sent, failed)
 }
 
 func isGone(err error) bool {
@@ -164,7 +174,7 @@ func isGone(err error) bool {
 func handleVAPIDPublicKey(w http.ResponseWriter, r *http.Request) {
 	w.Header().Set("Content-Type", "application/json")
 	json.NewEncoder(w).Encode(map[string]string{
-		"publicKey": signer.PublicKeyBase64(),
+		"publicKey": base64.RawURLEncoding.EncodeToString(signer.PublicKey()),
 	})
 }
 
@@ -209,7 +219,7 @@ func handleSubscribe(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	log.Printf("New subscription: %s", record.ID)
+	clog.Infof("New subscription: %s", record.ID)
 
 	w.Header().Set("Content-Type", "application/json")
 	json.NewEncoder(w).Encode(map[string]string{
@@ -237,7 +247,7 @@ func handleUnsubscribe(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	log.Printf("Unsubscribed: %s", req.Endpoint)
+	clog.Infof("Unsubscribed: %s", req.Endpoint)
 
 	w.Header().Set("Content-Type", "application/json")
 	json.NewEncoder(w).Encode(map[string]string{

go.mod

@@ -4,9 +4,11 @@ go 1.24.10
 
 require (
 	cloud.google.com/go/kms v1.23.2
+	github.com/chainguard-dev/clog v1.7.0
 	github.com/google/uuid v1.6.0
-	github.com/mattn/go-sqlite3 v1.14.32
+	github.com/sethvargo/go-envconfig v1.3.0
 	golang.org/x/crypto v0.45.0
+	modernc.org/sqlite v1.40.1
 )
 
 require (
@@ -16,18 +18,23 @@ require (
 	cloud.google.com/go/compute/metadata v0.8.0 // indirect
 	cloud.google.com/go/iam v1.5.2 // indirect
 	cloud.google.com/go/longrunning v0.6.7 // indirect
+	github.com/dustin/go-humanize v1.0.1 // indirect
 	github.com/felixge/httpsnoop v1.0.4 // indirect
 	github.com/go-logr/logr v1.4.3 // indirect
 	github.com/go-logr/stdr v1.2.2 // indirect
 	github.com/google/s2a-go v0.1.9 // indirect
 	github.com/googleapis/enterprise-certificate-proxy v0.3.6 // indirect
 	github.com/googleapis/gax-go/v2 v2.15.0 // indirect
+	github.com/mattn/go-isatty v0.0.20 // indirect
+	github.com/ncruces/go-strftime v0.1.9 // indirect
+	github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec // indirect
 	go.opentelemetry.io/auto/sdk v1.1.0 // indirect
 	go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.61.0 // indirect
 	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.61.0 // indirect
 	go.opentelemetry.io/otel v1.36.0 // indirect
 	go.opentelemetry.io/otel/metric v1.36.0 // indirect
 	go.opentelemetry.io/otel/trace v1.36.0 // indirect
+	golang.org/x/exp v0.0.0-20250620022241-b7579e27df2b // indirect
 	golang.org/x/net v0.47.0 // indirect
 	golang.org/x/oauth2 v0.30.0 // indirect
 	golang.org/x/sync v0.18.0 // indirect
@@ -40,4 +47,7 @@ require (
 	google.golang.org/genproto/googleapis/rpc v0.0.0-20250811230008-5f3141c8851a // indirect
 	google.golang.org/grpc v1.74.2 // indirect
 	google.golang.org/protobuf v1.36.7 // indirect
+	modernc.org/libc v1.66.10 // indirect
+	modernc.org/mathutil v1.7.1 // indirect
+	modernc.org/memory v1.11.0 // indirect
 )

go.sum

@@ -12,8 +12,12 @@ cloud.google.com/go/kms v1.23.2 h1:4IYDQL5hG4L+HzJBhzejUySoUOheh3Lk5YT4PCyyW6k=
 cloud.google.com/go/kms v1.23.2/go.mod h1:rZ5kK0I7Kn9W4erhYVoIRPtpizjunlrfU4fUkumUp8g=
 cloud.google.com/go/longrunning v0.6.7 h1:IGtfDWHhQCgCjwQjV9iiLnUta9LBCo8R9QmAFsS/PrE=
 cloud.google.com/go/longrunning v0.6.7/go.mod h1:EAFV3IZAKmM56TyiE6VAP3VoTzhZzySwI/YI1s/nRsY=
+github.com/chainguard-dev/clog v1.7.0 h1:guPznsK8vLHvzz1QJe2yU6MFeYaiSOFOQBYw4OXu+g8=
+github.com/chainguard-dev/clog v1.7.0/go.mod h1:4+WFhRMsGH79etYXY3plYdp+tCz/KCkU8fAr0HoaPvs=
 github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/dustin/go-humanize v1.0.1 h1:GzkhY7T5VNhEkwH0PVJgjz+fX1rhBrR7pRT3mDkpeCY=
+github.com/dustin/go-humanize v1.0.1/go.mod h1:Mu1zIs6XwVuF/gI1OepvI0qD18qycQx+mFykh5fBlto=
 github.com/felixge/httpsnoop v1.0.4 h1:NFTV2Zj1bL4mc9sqWACXbQFVBBg2W3GPvqp8/ESS2Wg=
 github.com/felixge/httpsnoop v1.0.4/go.mod h1:m8KPJKqk1gH5J9DgRY2ASl2lWCfGKXixSwevea8zH2U=
 github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
@@ -25,6 +29,8 @@ github.com/golang/protobuf v1.5.4 h1:i7eJL8qZTpSEXOPTxNKhASYpMn+8e5Q6AdndVa1dWek
 github.com/golang/protobuf v1.5.4/go.mod h1:lnTiLA8Wa4RWRcIUkrtSVa5nRhsEGBg48fD6rSs7xps=
 github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
 github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
+github.com/google/pprof v0.0.0-20250317173921-a4b03ec1a45e h1:ijClszYn+mADRFY17kjQEVQ1XRhq2/JR1M3sGqeJoxs=
+github.com/google/pprof v0.0.0-20250317173921-a4b03ec1a45e/go.mod h1:boTsfXsheKC2y+lKOCMpSfarhxDeIzfZG1jqGcPl3cA=
 github.com/google/s2a-go v0.1.9 h1:LGD7gtMgezd8a/Xak7mEWL0PjoTQFvpRudN895yqKW0=
 github.com/google/s2a-go v0.1.9/go.mod h1:YA0Ei2ZQL3acow2O62kdp9UlnvMmU7kA6Eutn0dXayM=
 github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
@@ -33,10 +39,16 @@ github.com/googleapis/enterprise-certificate-proxy v0.3.6 h1:GW/XbdyBFQ8Qe+YAmFU
 github.com/googleapis/enterprise-certificate-proxy v0.3.6/go.mod h1:MkHOF77EYAE7qfSuSS9PU6g4Nt4e11cnsDUowfwewLA=
 github.com/googleapis/gax-go/v2 v2.15.0 h1:SyjDc1mGgZU5LncH8gimWo9lW1DtIfPibOG81vgd/bo=
 github.com/googleapis/gax-go/v2 v2.15.0/go.mod h1:zVVkkxAQHa1RQpg9z2AUCMnKhi0Qld9rcmyfL1OZhoc=
-github.com/mattn/go-sqlite3 v1.14.32 h1:JD12Ag3oLy1zQA+BNn74xRgaBbdhbNIDYvQUEuuErjs=
+github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY=
-github.com/mattn/go-sqlite3 v1.14.32/go.mod h1:Uh1q+B4BYcTPb+yiD3kU8Ct7aC0hY9fxUwlHK0RXw+Y=
+github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
+github.com/ncruces/go-strftime v0.1.9 h1:bY0MQC28UADQmHmaF5dgpLmImcShSi2kHU9XLdhx/f4=
+github.com/ncruces/go-strftime v0.1.9/go.mod h1:Fwc5htZGVVkseilnfgOVb9mKy6w1naJmn9CehxcKcls=
 github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
+github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec h1:W09IVJc94icq4NjY3clb7Lk8O1qJ8BdBEF8z0ibU0rE=
+github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec/go.mod h1:qqbHyh8v60DhA7CoWK5oRCqLrMHRGoxYCSS9EjAz6Eo=
+github.com/sethvargo/go-envconfig v1.3.0 h1:gJs+Fuv8+f05omTpwWIu6KmuseFAXKrIaOZSh8RMt0U=
+github.com/sethvargo/go-envconfig v1.3.0/go.mod h1:JLd0KFWQYzyENqnEPWWZ49i4vzZo/6nRidxI8YvGiHw=
 github.com/stretchr/testify v1.10.0 h1:Xv5erBjTwe/5IxqUQTdXv5kgmIvbHo3QQyRwhJsOfJA=
 github.com/stretchr/testify v1.10.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
 go.opentelemetry.io/auto/sdk v1.1.0 h1:cH53jehLUN6UFLY71z+NDOiNJqDdPRaXzTel0sJySYA=
@@ -57,18 +69,25 @@ go.opentelemetry.io/otel/trace v1.36.0 h1:ahxWNuqZjpdiFAyrIoQ4GIiAIhxAunQR6MUoKr
 go.opentelemetry.io/otel/trace v1.36.0/go.mod h1:gQ+OnDZzrybY4k4seLzPAWNwVBBVlF2szhehOBB/tGA=
 golang.org/x/crypto v0.45.0 h1:jMBrvKuj23MTlT0bQEOBcAE0mjg8mK9RXFhRH6nyF3Q=
 golang.org/x/crypto v0.45.0/go.mod h1:XTGrrkGJve7CYK7J8PEww4aY7gM3qMCElcJQ8n8JdX4=
+golang.org/x/exp v0.0.0-20250620022241-b7579e27df2b h1:M2rDM6z3Fhozi9O7NWsxAkg/yqS/lQJ6PmkyIV3YP+o=
+golang.org/x/exp v0.0.0-20250620022241-b7579e27df2b/go.mod h1:3//PLf8L/X+8b4vuAfHzxeRUl04Adcb341+IGKfnqS8=
+golang.org/x/mod v0.29.0 h1:HV8lRxZC4l2cr3Zq1LvtOsi/ThTgWnUk/y64QSs8GwA=
+golang.org/x/mod v0.29.0/go.mod h1:NyhrlYXJ2H4eJiRy/WDBO6HMqZQ6q9nk4JzS3NuCK+w=
 golang.org/x/net v0.47.0 h1:Mx+4dIFzqraBXUugkia1OOvlD6LemFo1ALMHjrXDOhY=
 golang.org/x/net v0.47.0/go.mod h1:/jNxtkgq5yWUGYkaZGqo27cfGZ1c5Nen03aYrrKpVRU=
 golang.org/x/oauth2 v0.30.0 h1:dnDm7JmhM45NNpd8FDDeLhK6FwqbOf4MLCM9zb1BOHI=
 golang.org/x/oauth2 v0.30.0/go.mod h1:B++QgG3ZKulg6sRPGD/mqlHQs5rB3Ml9erfeDY7xKlU=
 golang.org/x/sync v0.18.0 h1:kr88TuHDroi+UVf+0hZnirlk8o8T+4MrK6mr60WkH/I=
 golang.org/x/sync v0.18.0/go.mod h1:9KTHXmSnoGruLpwFjVSX0lNNA75CykiMECbovNTZqGI=
+golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.38.0 h1:3yZWxaJjBmCWXqhN1qh02AkOnCQ1poK6oF+a7xWL6Gc=
 golang.org/x/sys v0.38.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks=
 golang.org/x/text v0.31.0 h1:aC8ghyu4JhP8VojJ2lEHBnochRno1sgL6nEi9WGFGMM=
 golang.org/x/text v0.31.0/go.mod h1:tKRAlv61yKIjGGHX/4tP1LTbc13YSec1pxVEWXzfoeM=
 golang.org/x/time v0.12.0 h1:ScB/8o8olJvc+CQPWrK3fPZNfh7qgwCrY0zJmoEQLSE=
 golang.org/x/time v0.12.0/go.mod h1:CDIdPxbZBQxdj6cxyCIdrNogrJKMJ7pr37NYpMcMDSg=
+golang.org/x/tools v0.38.0 h1:Hx2Xv8hISq8Lm16jvBZ2VQf+RLmbd7wVUsALibYI/IQ=
+golang.org/x/tools v0.38.0/go.mod h1:yEsQ/d/YK8cjh0L6rZlY8tgtlKiBNTL14pGDJPJpYQs=
 google.golang.org/api v0.247.0 h1:tSd/e0QrUlLsrwMKmkbQhYVa109qIintOls2Wh6bngc=
 google.golang.org/api v0.247.0/go.mod h1:r1qZOPmxXffXg6xS5uhx16Fa/UFY8QU/K4bfKrnvovM=
 google.golang.org/genproto v0.0.0-20250603155806-513f23925822 h1:rHWScKit0gvAPuOnu87KpaYtjK5zBMLcULh7gxkCXu4=
@@ -83,3 +102,29 @@ google.golang.org/protobuf v1.36.7 h1:IgrO7UwFQGJdRNXH/sQux4R1Dj1WAKcLElzeeRaXV2
 google.golang.org/protobuf v1.36.7/go.mod h1:jduwjTPXsFjZGTmRluh+L6NjiWu7pchiJ2/5YcXBHnY=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
+modernc.org/cc/v4 v4.26.5 h1:xM3bX7Mve6G8K8b+T11ReenJOT+BmVqQj0FY5T4+5Y4=
+modernc.org/cc/v4 v4.26.5/go.mod h1:uVtb5OGqUKpoLWhqwNQo/8LwvoiEBLvZXIQ/SmO6mL0=
+modernc.org/ccgo/v4 v4.28.1 h1:wPKYn5EC/mYTqBO373jKjvX2n+3+aK7+sICCv4Fjy1A=
+modernc.org/ccgo/v4 v4.28.1/go.mod h1:uD+4RnfrVgE6ec9NGguUNdhqzNIeeomeXf6CL0GTE5Q=
+modernc.org/fileutil v1.3.40 h1:ZGMswMNc9JOCrcrakF1HrvmergNLAmxOPjizirpfqBA=
+modernc.org/fileutil v1.3.40/go.mod h1:HxmghZSZVAz/LXcMNwZPA/DRrQZEVP9VX0V4LQGQFOc=
+modernc.org/gc/v2 v2.6.5 h1:nyqdV8q46KvTpZlsw66kWqwXRHdjIlJOhG6kxiV/9xI=
+modernc.org/gc/v2 v2.6.5/go.mod h1:YgIahr1ypgfe7chRuJi2gD7DBQiKSLMPgBQe9oIiito=
+modernc.org/goabi0 v0.2.0 h1:HvEowk7LxcPd0eq6mVOAEMai46V+i7Jrj13t4AzuNks=
+modernc.org/goabi0 v0.2.0/go.mod h1:CEFRnnJhKvWT1c1JTI3Avm+tgOWbkOu5oPA8eH8LnMI=
+modernc.org/libc v1.66.10 h1:yZkb3YeLx4oynyR+iUsXsybsX4Ubx7MQlSYEw4yj59A=
+modernc.org/libc v1.66.10/go.mod h1:8vGSEwvoUoltr4dlywvHqjtAqHBaw0j1jI7iFBTAr2I=
+modernc.org/mathutil v1.7.1 h1:GCZVGXdaN8gTqB1Mf/usp1Y/hSqgI2vAGGP4jZMCxOU=
+modernc.org/mathutil v1.7.1/go.mod h1:4p5IwJITfppl0G4sUEDtCr4DthTaT47/N3aT6MhfgJg=
+modernc.org/memory v1.11.0 h1:o4QC8aMQzmcwCK3t3Ux/ZHmwFPzE6hf2Y5LbkRs+hbI=
+modernc.org/memory v1.11.0/go.mod h1:/JP4VbVC+K5sU2wZi9bHoq2MAkCnrt2r98UGeSK7Mjw=
+modernc.org/opt v0.1.4 h1:2kNGMRiUjrp4LcaPuLY2PzUfqM/w9N23quVwhKt5Qm8=
+modernc.org/opt v0.1.4/go.mod h1:03fq9lsNfvkYSfxrfUhZCWPk1lm4cq4N+Bh//bEtgns=
+modernc.org/sortutil v1.2.1 h1:+xyoGf15mM3NMlPDnFqrteY07klSFxLElE2PVuWIJ7w=
+modernc.org/sortutil v1.2.1/go.mod h1:7ZI3a3REbai7gzCLcotuw9AC4VZVpYMjDzETGsSMqJE=
+modernc.org/sqlite v1.40.1 h1:VfuXcxcUWWKRBuP8+BR9L7VnmusMgBNNnBYGEe9w/iY=
+modernc.org/sqlite v1.40.1/go.mod h1:9fjQZ0mB1LLP0GYrp39oOJXx/I2sxEnZtzCmEQIKvGE=
+modernc.org/strutil v1.2.1 h1:UneZBkQA+DX2Rp35KcM69cSsNES9ly8mQWD71HKlOA0=
+modernc.org/strutil v1.2.1/go.mod h1:EHkiggD70koQxjVdSBM3JKM7k6L0FbGE5eymy9i3B9A=
+modernc.org/token v1.1.0 h1:Xl7Ap9dKaEs5kLoOQeQmPWevfnk/DM5qcLcYlA8ys6Y=
+modernc.org/token v1.1.0/go.mod h1:UGzOrNV1mAFSEB63lOFHIpNRUVMvYTc6yu1SMY/XTDM=

storage/sqlite.go

@@ -7,7 +7,7 @@ import (
 	"time"
 
 	"github.com/imjasonh/webpush"
-	_ "github.com/mattn/go-sqlite3" // SQLite driver
+	_ "modernc.org/sqlite" // SQLite driver
 )
 
 // SQLite implements storage using SQLite.
@@ -18,7 +18,7 @@ type SQLite struct {
 // NewSQLite creates a new SQLite storage.
 // dsn is the data source name, e.g., "webpush.db" or ":memory:".
 func NewSQLite(dsn string) (*SQLite, error) {
-	db, err := sql.Open("sqlite3", dsn)
+	db, err := sql.Open("sqlite", dsn)
 	if err != nil {
 		return nil, fmt.Errorf("opening database: %w", err)
 	}