coreos-ostree-importer: switch to plain http(s) url #66
Conversation
We'll send the messages with a plain http(s) url so that this importer doesn't need to be configured with AWS credentials.
|
Also, switch to Fedora 31 |
|
@dustymabe can we use https://builds.coreos.fedoraproject.org/ as the base URL perhaps? |
yep, added a commit on top that updates the example fedora message. |
This one works in recent testing.
| s3.download_file(bucket, key, filepath) | ||
| # Grab file from the url | ||
| logger.info(f"Downloading object from url: {url}") | ||
| urllib.request.urlretrieve(url, filepath) |
There was a problem hiding this comment.
Just a side note, but we should also download the signature and verify it before importing. E.g. we can add a commit-sig to the message?
There was a problem hiding this comment.
We already check the sha256sum. The only thing I can think that the signature file would help us with is to make sure only signed content got into the repo (i.e. if we're worried about an attacker trying to send a message to import invalid content), but I can think of even better ways to do that too. One of them would be to verify the commit in the ostree repo after the file was untarred, but before it was imported.
There was a problem hiding this comment.
One of them would be to verify the commit in the ostree repo after the file was untarred, but before it was imported.
Hmm, I thought that was already the case. We definitely should do this too if not. Ahh OK yup, we need to explicitly do --gpgverify.
We already check the sha256sum. The only thing I can think that the signature file would help us with is to make sure only signed content got into the repo (i.e. if we're worried about an attacker trying to send a message to import invalid content)
One argument for requiring a signature on the tarball itself is to sanity check that it's not malicious before trying to extract it. Actually, even the docs for TarFile.extractall() has a warning related to this.
So I think we should do both.
There was a problem hiding this comment.
so:
- remove checksum and apply signature checking for the tarball
- add commit checking in extracted ostree repo
?
There was a problem hiding this comment.
pushing that bit to a followup: #68
We'll send the messages with a plain http(s) url so that this importer
doesn't need to be configured with AWS credentials.