Optional: Signing the Lambda Layers with AWS Code Signing

Abierto
  • ¿Algo no está bien?
#1,963 1 comentario 5 reacciones 0 asignados Ver en GitHub

Los mantenedores suelen responder en 2 días

Nadie ha tomado este issue todavía.

Evaluación

Dificultad
4/5
Tiempo estimado
3-5 días
Aptitud para principiantes
42/100
Tipo de issue
Nueva funcionalidad
Claridad
Bastante claro
Estado de actividad
Estancado
Stack tecnológico
aws, github-actions
Área
ci-cd, cloud, release, security

Línea de trabajo

Comienza con .github/workflows/publish-layer-collector.yml y revisa la documentación de AWS Code Signing y el comando de ejemplo del issue. Traza cómo el workflow carga los ZIPs de las capas y, a continuación, determina cómo deberían encajar la entrada opcional del perfil de firma, los permisos de firma OIDC, el versionado de S3 y las atestaciones de artefactos. Se considera terminado cuando el workflow puede habilitar la firma sin afectar a su ruta predeterminada.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

enhancement

Is your feature request related to a problem? Please describe.

https://github.com/open-telemetry/opentelemetry-lambda/blob/main/.github/workflows/publish-layer-collector.yml

Running the above workflow to produce private layers.

If a team is running an AWS CodeSigner, then the publish job should also include an optional capability to sign the layers to confirm the provenance.

https://docs.aws.amazon.com/lambda/latest/dg/governance-code-signing.html

Describe the solution you'd like

I'd like the GitHub action to include an artefact attestation for the zip binaries and each of the language-specific binaries released.
https://docs.github.com/en/actions/how-tos/secure-your-work/use-artifact-attestations/use-artifact-attestations and couple that with AWS's codesigner for the zip files.

aws signer start-signing-job \
--source 's3={bucketName=xxxx,key=collector-layer.zip,version=xxxxx}' \
--destination 's3={bucketName=xxxx,prefix=signed/}' \
--profile-name SigningProfile_XXXXX
--client-request-token XXXUNIQUE_FROM_GITHUB_JOB

The additional parameter would need to be the SigningProfile, that would need to be present in the account that the GHA is uploading to.

Prerequisites

  • The Github OIDC role would also need permission to be able to sign.
  • The S3 bucket needs to have versioning enabled.

Describe alternatives you've considered

I think the GitHub attestation step is optional, but could allow extra confidence that the artefacts have not been tampered with, especially if the signing job connects directly to the GitHub attestation.

Additional context

I'm keen to raise a PR to demonstrate that this could be an optional extra; but wanted to raise the issue first as I couldn't find evidence of where this has been/not-been considered.

Tip: React with 👍 to help prioritize this issue. Please use comments to provide useful context, avoiding +1 or me too, to help us triage it. Learn more here.

Lenguaje dominante
Go
Estrellas
433
Forks
249
Merge medio
1 d 12 h
PR fusionados (30 d)
39

Preparar el entorno

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de open-telemetry/opentelemetry-lambda

Todos los issues de open-telemetry/opentelemetry-lambda

Issues similares

Más issues de Go

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.