Skip to content

Commit 9e16479

Browse files
nhinschnhinsch
authored
Sign layer using AWS Signer before publishing (#99)
1 parent 4d81a88 commit 9e16479

File tree

4 files changed

+129
-14
lines changed

4 files changed

+129
-14
lines changed

‎scripts/publish_prod.sh

Lines changed: 13 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -57,22 +57,26 @@ then
5757
[[ "$0" = "$BASH_SOURCE" ]] && exit 1 || return 1
5858
fi
5959

60-
echo ""
60+
echo
6161
echo "Replacing __version__ in ./datadog_lambda/__init__.py"
62-
echo ""
62+
echo
6363
sed -i "" -E "s/\"(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\"/\"$NEW_VERSION\"/" ./datadog_lambda/__init__.py
6464

6565
git commit ./datadog_lambda/__init__.py -m "Update module version to ${NEW_VERSION}"
6666

67-
echo ""
67+
echo
6868
echo "Building layers..."
6969
./scripts/build_layers.sh
7070

71-
echo ""
71+
echo
72+
echo "Signing layers..."
73+
./scripts/sign_layers.sh prod
74+
75+
echo
7276
echo "Publishing layers to AWS regions..."
7377
./scripts/publish_layers.sh
7478

75-
echo ""
79+
echo
7680
echo 'Pushing updates to github'
7781
MINOR_VERSION=$(echo $NEW_VERSION | cut -d '.' -f 2)
7882
git push origin master
@@ -89,14 +93,14 @@ if [[ ! $REPLY =~ ^[Yy]$ ]]
8993
then
9094
[[ "$0" = "$BASH_SOURCE" ]] && exit 1 || return 1
9195
fi
92-
echo ""
96+
echo
9397
echo "Publishing to https://pypi.org/project/datadog-lambda/"
9498
./scripts/pypi.sh
9599

96-
echo ""
100+
echo
97101
echo "Now create a new release with the tag v${MINOR_VERSION} created"
98102
echo "https://github.com/DataDog/datadog-lambda-python/releases/new"
99-
echo ""
103+
echo
100104
echo "Then publish a new serverless-plugin-datadog version with the new layer versions!"
101-
echo ""
105+
echo
102106

‎scripts/publish_sandbox.sh

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
#!/bin/bash
2+
set -e
3+
4+
./scripts/build_layers.sh
5+
./scripts/sign_layers.sh sandbox
6+
./scripts/publish_layers.sh sa-east-1

‎scripts/publish_staging.sh

Lines changed: 0 additions & 5 deletions
This file was deleted.

‎scripts/sign_layers.sh

Lines changed: 110 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,110 @@
1+
#!/bin/bash
2+
3+
# Unless explicitly stated otherwise all files in this repository are licensed
4+
# under the Apache License Version 2.0.
5+
# This product includes software developed at Datadog (https://www.datadoghq.com/).
6+
# Copyright 2019 Datadog, Inc.
7+
8+
set -e
9+
10+
LAYER_DIR=".layers"
11+
LAYER_FILES=(
12+
"datadog_lambda_py2.7.zip"
13+
"datadog_lambda_py3.6.zip"
14+
"datadog_lambda_py3.7.zip"
15+
"datadog_lambda_py3.8.zip"
16+
)
17+
SIGNING_PROFILE_NAME="DatadogLambdaSigningProfile"
18+
19+
# Check account parameter
20+
VALID_ACCOUNTS=("sandbox" "prod")
21+
if [ -z "$1" ]; then
22+
echo "ERROR: You must pass an account parameter to sign the layers"
23+
exit 1
24+
fi
25+
if [[ ! "${VALID_ACCOUNTS[@]}" =~ $1 ]]; then
26+
echo "ERROR: The account parameter was invalid. Please choose sandbox or prod."
27+
exit 1
28+
fi
29+
if [ "$1" = "sandbox" ]; then
30+
REGION="sa-east-1"
31+
S3_BUCKET_NAME="dd-lambda-signing-bucket-sandbox"
32+
fi
33+
if [ "$1" = "prod" ]; then
34+
REGION="us-east-1"
35+
S3_BUCKET_NAME="dd-lambda-signing-bucket"
36+
fi
37+
38+
for LAYER_FILE in "${LAYER_FILES[@]}"
39+
do
40+
echo
41+
echo "${LAYER_FILE}"
42+
echo "-------------------------"
43+
44+
LAYER_LOCAL_PATH="${LAYER_DIR}/${LAYER_FILE}"
45+
46+
# Upload the layer to S3 for signing
47+
echo "Uploading layer to S3 for signing..."
48+
UUID=$(uuidgen)
49+
S3_UNSIGNED_ZIP_KEY="${UUID}.zip"
50+
S3_UNSIGNED_ZIP_URI="s3://${S3_BUCKET_NAME}/${S3_UNSIGNED_ZIP_KEY}"
51+
aws s3 cp $LAYER_LOCAL_PATH $S3_UNSIGNED_ZIP_URI
52+
53+
# Start a signing job
54+
echo "Starting the signing job..."
55+
SIGNING_JOB_ID=$(aws signer start-signing-job \
56+
--source "s3={bucketName=${S3_BUCKET_NAME},key=${S3_UNSIGNED_ZIP_KEY},version=null}" \
57+
--destination "s3={bucketName=${S3_BUCKET_NAME}}" \
58+
--profile-name $SIGNING_PROFILE_NAME \
59+
--region $REGION \
60+
| jq -r '.jobId'\
61+
)
62+
63+
# Wait for the signing job to complete
64+
echo "Waiting for the signing job to complete..."
65+
SECONDS_WAITED_SO_FAR=0
66+
while :
67+
do
68+
sleep 3
69+
SECONDS_WAITED_SO_FAR=$((SECONDS_WAITED_SO_FAR + 3))
70+
71+
SIGNING_JOB_DESCRIPTION=$(aws signer describe-signing-job \
72+
--job-id $SIGNING_JOB_ID \
73+
--region $REGION\
74+
)
75+
SIGNING_JOB_STATUS=$(echo $SIGNING_JOB_DESCRIPTION | jq -r '.status')
76+
SIGNING_JOB_STATUS_REASON=$(echo $SIGNING_JOB_DESCRIPTION | jq -r '.statusReason')
77+
78+
if [ $SIGNING_JOB_STATUS = "Succeeded" ]; then
79+
echo "Signing job succeeded!"
80+
break
81+
fi
82+
83+
if [ $SIGNING_JOB_STATUS = "Failed" ]; then
84+
echo "ERROR: Signing job failed"
85+
echo $SIGNING_JOB_STATUS_REASON
86+
exit 1
87+
fi
88+
89+
if [ $SECONDS_WAITED_SO_FAR -ge 60 ]; then
90+
echo "ERROR: Timed out waiting for the signing job to complete"
91+
exit 1
92+
fi
93+
94+
echo "Signing job still in progress..."
95+
done
96+
97+
# Download the signed ZIP, overwriting the original ZIP
98+
echo "Replacing the local layer with the signed layer from S3..."
99+
S3_SIGNED_ZIP_KEY="${SIGNING_JOB_ID}.zip"
100+
S3_SIGNED_ZIP_URI="s3://${S3_BUCKET_NAME}/${S3_SIGNED_ZIP_KEY}"
101+
aws s3 cp $S3_SIGNED_ZIP_URI $LAYER_LOCAL_PATH
102+
103+
# Delete the signed and unsigned ZIPs in S3
104+
echo "Cleaning up the S3 bucket..."
105+
aws s3api delete-object --bucket $S3_BUCKET_NAME --key $S3_UNSIGNED_ZIP_KEY
106+
aws s3api delete-object --bucket $S3_BUCKET_NAME --key $S3_SIGNED_ZIP_KEY
107+
done
108+
109+
echo
110+
echo "Successfully signed all layers!"

0 commit comments

Comments
 (0)