Feature request: Reproducible ZIP packages

Open Beginner friendly
#4,645 4 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
2/5
Estimated time
1-3 hours
Newbie friendliness
68/100
Issue type
Feature
Clarity
Mostly clear
Activity status
Quiet
Tech stack
python
Domain
cli

Research direction

Start in samcli/lib/package/utils.py around lines 241-242, where files are added to the ZIP, and inspect the surrounding packaging flow. Ensure the package contents have a predictable order and epoch timestamps, then verify that generated ZIP packages are reproducible.

Written by the indexing model from the issue text.

Description

type/feature
Describe your idea/feature/enhancement

For verification/auditing purposes, it is quite nice to have reproducible SAM zip packages.

Proposal

We will need to sort the files here in a predictable way before adding them to the zip.

https://github.com/aws/aws-sam-cli/blob/ee23953806be066ebfb72dd42e188de4866483ae/samcli/lib/package/utils.py#L241-L242

Also, we should reset the timestamps to epoch.

Things to consider:

  1. Will this require any updates to the SAM Spec - No
  2. Will do this after https://github.com/aws/aws-sam-cli/pull/4644 is merged in.
Additional Details

I don't mind doing this myself. Semi-related to #4622.

Dominant language
Python
Stars
6.7k
Forks
1.2k
Avg merge
22h 43m
Merged PRs (30d)
47

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from aws/aws-sam-cli

All issues in aws/aws-sam-cli

Similar issues

More Python issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.