Optional: Signing the Lambda Layers with AWS Code Signing
维护者通常 2 天内回复
还没有人认领这个 Issue。
评估
- 难度
- 4/5
- 预计耗时
- 3-5 天
- 新手友好度
- 42/100
调研方向
从 .github/workflows/publish-layer-collector.yml 开始，查看 AWS Code Signing 文档以及 issue 中的示例命令。跟踪 workflow 如何上传 layer ZIP，然后确定可选的 signing-profile input、OIDC signing permissions、S3 versioning 和 artifact attestations 应如何配合。完成的标准是 workflow 可以启用 signing，同时不影响其默认路径。
由索引模型根据 Issue 内容生成。
描述
Is your feature request related to a problem? Please describe.
Running the above workflow to produce private layers.
If a team is running an AWS CodeSigner, then the publish job should also include an optional capability to sign the layers to confirm the provenance.
https://docs.aws.amazon.com/lambda/latest/dg/governance-code-signing.html
Describe the solution you'd like
I'd like the GitHub action to include an artefact attestation for the zip binaries and each of the language-specific binaries released.
https://docs.github.com/en/actions/how-tos/secure-your-work/use-artifact-attestations/use-artifact-attestations and couple that with AWS's codesigner for the zip files.
aws signer start-signing-job \
--source 's3={bucketName=xxxx,key=collector-layer.zip,version=xxxxx}' \
--destination 's3={bucketName=xxxx,prefix=signed/}' \
--profile-name SigningProfile_XXXXX
--client-request-token XXXUNIQUE_FROM_GITHUB_JOB
The additional parameter would need to be the SigningProfile, that would need to be present in the account that the GHA is uploading to.
Prerequisites
- The Github OIDC role would also need permission to be able to sign.
- The S3 bucket needs to have versioning enabled.
Describe alternatives you've considered
I think the GitHub attestation step is optional, but could allow extra confidence that the artefacts have not been tampered with, especially if the signing job connects directly to the GitHub attestation.
Additional context
I'm keen to raise a PR to demonstrate that this could be an optional extra; but wanted to raise the issue first as I couldn't find evidence of where this has been/not-been considered.
Tip: React with 👍 to help prioritize this issue. Please use comments to provide useful context, avoiding +1 or me too, to help us triage it. Learn more here.
- 主要语言
- Go
- 星标
- 433
- 派生
- 249
- 平均合并
- 1 天 12 小时
- 30 天内合并 PR
- 39
环境准备
- 没有 Dockerfile 或 Docker Compose 文件
- 没有 Pull Request 模板
- 阅读贡献指南
从这里开始
- 先读完整个 Issue，再读项目的贡献指南。
- 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
- Fork 仓库，在一个分支上完成修改。
- 提交 Pull Request，并在描述里引用这个 Issue 编号。
open-telemetry/opentelemetry-lambda 的其他 Issue
-
enhancement ruby
难度 2/5 1-3 小时 新手友好度 64/100
open-telemetry/opentelemetry-lambda#2741 ·
维护者通常 2 天内回复
-
processor/cold_start
难度 2/5 1-3 小时 新手友好度 67/100
open-telemetry/opentelemetry-lambda#2738 ·
维护者通常 2 天内回复
-
go
难度 2/5 1-3 小时 新手友好度 64/100
open-telemetry/opentelemetry-lambda#2736 ·
维护者通常 2 天内回复
-
enhancement javascript
难度 5/5 一周以上 新手友好度 35/100
open-telemetry/opentelemetry-lambda#2744 ·
维护者通常 2 天内回复
-
enhancement python
难度 3/5 1-2 天 新手友好度 55/100
open-telemetry/opentelemetry-lambda#2742 ·
维护者通常 2 天内回复
查看 open-telemetry/opentelemetry-lambda 的全部 Issue
相似的 Issue
-
难度 2/5 1-3 小时 新手友好度 65/100
rancher/rancher-ai-mcp#206 ·
维护者通常 1 天内回复
-
bug
难度 2/5 1-3 小时 新手友好度 85/100
open-telemetry/opentelemetry-go-compile-instrumentation#1743 ·
维护者通常 2 天内回复
-
难度 2/5 1-3 小时 新手友好度 68/100
tomasz-tomczyk/crit#1159 ·
维护者通常 1 天内回复
-
SelectOneHealthyInstance panics when instance weights are fractional (e.g. 0.5)可能已有人在做 @Ajax-1 今天认领。 未关闭
难度 2/5 1-3 小时 新手友好度 82/100
nacos-group/nacos-sdk-go#929 ·
-
难度 2/5 1-3 小时 新手友好度 78/100
google/osv-scanner#3270 ·
维护者通常 1 天内回复