Partially patch AWS crates for qos_enclave #607
Draft
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
cr-tk
changed the title
cr-tk
force-pushed
the
christian/aws-bump
branch
from
4bdd6d1 to
7f175a7
Compare
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Summary & Motivation (Problem vs. Solution)
AWS has recently announced GHSA-g59m-gf8j-gjf5 which classifies a recent improvement in their API across in many of their Rust SDK crates as a security patch. This is a motivation to adopt newer versions of the AWS SDK crates that we use for
qos_enclave.At the time of writing, we can not switch
aws-sdk-kmsto a new enough version since other AWS crates such asaws-nitro-enclaves-image-formatexplicitly require use of older versions, see aws/aws-nitro-enclaves-image-format#49.Additional restrictions on
aws-configversion ranges, combined with cargo restrictions on allowed parallel usage of different major versions of the same crate (such asaws-types1.1.9and1.3.11) unfortunately make it difficult for us to adopt the newer versions.For example, our tests build with
aws-types0.101.0but the fail withduring runtime, and newer
1.0.xor1.1.xversions aren't allowed due to the previously mentioned cargo rules. This holds back what this PR can currently do.The
aws-nitro-enclaves-image-formatdevelopment has finally droppedattyas a transitive dependency, allowing us to get rid of it and the related security warnings (unmaintained crate) as described in aws/aws-nitro-enclaves-image-format#44 . Since there's no official release for that yet, we have to use the Cargo patch mechanism as a workaround to enforce this.How I Tested These Changes
TBD