Skip to content

Commit 6aa9c48

Browse files
dfangldfangl
committed
Merge remote-tracking branch 'upstream/develop' into upstream-changes
2 parents 28d6661 + 71388dd commit 6aa9c48

File tree

10 files changed

+430
-240
lines changed

10 files changed

+430
-240
lines changed

‎.github/workflows/check-binaries.yml

+82
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,82 @@
1+
name: Check binaries
2+
3+
on:
4+
workflow_dispatch:
5+
schedule:
6+
- cron: "0 16 * * 1-5" # min h d Mo DoW / 9am PST M-F
7+
8+
jobs:
9+
check-for-vulnerabilities:
10+
runs-on: ubuntu-latest
11+
outputs:
12+
report_contents: ${{ steps.save-output.outputs.report_contents }}
13+
steps:
14+
- name: Setup python
15+
uses: actions/setup-python@v5
16+
with:
17+
python-version: '3.11'
18+
- name: Checkout code
19+
uses: actions/checkout@v4
20+
with:
21+
ref: main
22+
- name: Download latest release
23+
uses: robinraju/[email protected]
24+
with:
25+
latest: true
26+
fileName: 'aws-lambda-rie*'
27+
out-file-path: "bin"
28+
- name: Run check for vulnerabilities
29+
id: check-binaries
30+
run: |
31+
make check-binaries
32+
- if: always() && failure() # `always()` to run even if the previous step failed. Failure means that there are vulnerabilities
33+
name: Save content of the vulnerabilities report as GitHub output
34+
id: save-output
35+
run: |
36+
report_csv="$(ls -tr output.cve-bin-*.csv 2>/dev/null | tail -n1)" # last file generated
37+
if [ -z "$report_csv" ]; then
38+
echo "No file with vulnerabilities. Probably a failure in previous step."
39+
else
40+
echo "Vulnerabilities stored in $report_csv"
41+
fi
42+
final_report="${report_csv}.txt"
43+
awk -F',' '{n=split($10, path, "/"); print $2,$3,$4,$5,path[n]}' "$report_csv" | column -t > "$final_report" # make the CSV nicer
44+
echo "report_contents<<EOF" >> "$GITHUB_OUTPUT"
45+
cat "$final_report" >> "$GITHUB_OUTPUT"
46+
echo "EOF" >> "$GITHUB_OUTPUT"
47+
- if: always() && steps.save-output.outputs.report_contents
48+
name: Build new binaries and check vulnerabilities again
49+
id: check-new-version
50+
run: |
51+
mkdir ./bin2
52+
mv ./bin/* ./bin2
53+
make compile-with-docker-all
54+
latest_version=$(strings bin/aws-lambda-rie* | grep '^go1\.' | sort | uniq)
55+
echo "latest_version=$latest_version" >> "$GITHUB_OUTPUT"
56+
make check-binaries
57+
- if: always() && steps.save-output.outputs.report_contents
58+
name: Save outputs for the check with the latest build
59+
id: save-new-version
60+
run: |
61+
if [ "${{ steps.check-new-version.outcome }}" == "failure" ]; then
62+
fixed="No"
63+
else
64+
fixed="Yes"
65+
fi
66+
echo "fixed=$fixed" >> "$GITHUB_OUTPUT"
67+
- if: always() && steps.save-output.outputs.report_contents
68+
name: Create GitHub Issue indicating vulnerabilities
69+
id: create-issue
70+
uses: dacbd/create-issue-action@main
71+
with:
72+
token: ${{ github.token }}
73+
title: |
74+
CVEs found in latest RIE release
75+
body: |
76+
### CVEs found in latest RIE release
77+
```
78+
${{ steps.save-output.outputs.report_contents }}
79+
```
80+
81+
#### Are these resolved by building with the latest patch version of Go (${{ steps.check-new-version.outputs.latest_version }})?:
82+
> **${{ steps.save-new-version.outputs.fixed }}**

‎.github/workflows/integ-tests.yml

+49
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,49 @@
1+
name: Run Integration Tests
2+
3+
on:
4+
pull_request:
5+
branches:
6+
- develop
7+
8+
jobs:
9+
go-tests:
10+
runs-on: ubuntu-latest
11+
environment:
12+
name: integ-tests
13+
steps:
14+
- uses: actions/checkout@v4
15+
- name: run go tests
16+
run: make tests-with-docker
17+
integ-tests-x86:
18+
runs-on: ubuntu-latest
19+
environment:
20+
name: integ-tests
21+
steps:
22+
- uses: actions/checkout@v4
23+
- uses: actions/setup-python@v5
24+
with:
25+
python-version: '3.11'
26+
- name: run integration tests
27+
run: make integ-tests-with-docker-x86-64
28+
integ-tests-arm64:
29+
runs-on: ubuntu-latest
30+
environment:
31+
name: integ-tests
32+
steps:
33+
- uses: actions/checkout@v4
34+
- uses: actions/setup-python@v5
35+
with:
36+
python-version: '3.11'
37+
- name: run integration tests
38+
run: make integ-tests-with-docker-arm64
39+
integ-tests-old:
40+
runs-on: ubuntu-latest
41+
environment:
42+
name: integ-tests
43+
steps:
44+
- uses: actions/checkout@v4
45+
- uses: actions/setup-python@v5
46+
with:
47+
python-version: '3.11'
48+
- name: run integration tests
49+
run: make integ-tests-with-docker-old

‎.github/workflows/release.yml

+41
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
name: Release
2+
3+
on:
4+
workflow_dispatch:
5+
inputs:
6+
releaseVersion:
7+
description: "Version to use for the release."
8+
required: true
9+
default: "X.Y"
10+
releaseBody:
11+
description: "Information about the release"
12+
required: true
13+
default: "New release"
14+
jobs:
15+
Release:
16+
environment: Release
17+
runs-on: ubuntu-latest
18+
steps:
19+
- uses: actions/checkout@v4
20+
with:
21+
ref: main
22+
- name: Set up python
23+
uses: actions/setup-python@v5
24+
with:
25+
python-version: '3.11'
26+
- name: Build
27+
run: make compile-with-docker-all
28+
- name: Run Integ Tests
29+
run: |
30+
make tests-with-docker
31+
make integ-tests
32+
- name: Release
33+
uses: softprops/action-gh-release@v2
34+
with:
35+
name: Release ${{ github.event.inputs.releaseVersion }}
36+
tag_name: v${{ github.event.inputs.releaseVersion }}
37+
body: ${{ github.event.inputs.releaseBody }}
38+
files: |
39+
bin/aws-lambda-rie
40+
bin/aws-lambda-rie-arm64
41+
bin/aws-lambda-rie-x86_64

‎Makefile

+39-6
Original file line numberDiff line numberDiff line change
@@ -12,33 +12,66 @@ GO_ARCH_arm64 := arm64
1212
DESTINATION_x86_64 := bin/${BINARY_NAME}-x86_64
1313
DESTINATION_arm64 := bin/${BINARY_NAME}-arm64
1414

15+
run_in_docker = docker run --env GOPROXY=direct -v $(shell pwd):/LambdaRuntimeLocal -w /LambdaRuntimeLocal golang:1.22 $(1)
16+
1517
compile-with-docker-all:
16-
make ARCH=x86_64 compile-with-docker
17-
make ARCH=arm64 compile-with-docker
18+
$(call run_in_docker, make compile-lambda-linux-all)
1819

1920
compile-lambda-linux-all:
2021
make ARCH=x86_64 compile-lambda-linux
2122
make ARCH=arm64 compile-lambda-linux
2223

2324
compile-with-docker:
24-
docker run --rm --env GOPROXY=direct -v $(shell pwd):/LambdaRuntimeLocal -w /LambdaRuntimeLocal golang:1.20 make ARCH=${ARCH} compile-lambda-linux
25+
$(call run_in_docker, make ARCH=${ARCH} compile-lambda-linux)
2526

2627
compile-lambda-linux:
2728
CGO_ENABLED=0 GOOS=linux GOARCH=${GO_ARCH_${ARCH}} go build -buildvcs=false -ldflags "${RELEASE_BUILD_LINKER_FLAGS}" -gcflags="${GC_FLAGS}" -o ${DESTINATION_${ARCH}} ./cmd/localstack
2829

30+
tests-with-docker:
31+
$(call run_in_docker, make tests)
32+
2933
tests:
3034
go test ./...
3135

3236
integ-tests-and-compile: tests
3337
make compile-lambda-linux-all
3438
make integ-tests
3539

36-
integ-tests-with-docker: tests
40+
integ-tests-with-docker: tests-with-docker
3741
make compile-with-docker-all
3842
make integ-tests
39-
40-
integ-tests:
43+
44+
prep-python:
4145
python3 -m venv .venv
4246
.venv/bin/pip install --upgrade pip
4347
.venv/bin/pip install requests parameterized
48+
49+
exec-python-e2e-test:
4450
.venv/bin/python3 test/integration/local_lambda/test_end_to_end.py
51+
52+
integ-tests:
53+
make prep-python
54+
docker run --rm --privileged multiarch/qemu-user-static --reset -p yes
55+
make TEST_ARCH=x86_64 TEST_PORT=8002 exec-python-e2e-test
56+
make TEST_ARCH=arm64 TEST_PORT=9002 exec-python-e2e-test
57+
make TEST_ARCH="" TEST_PORT=9052 exec-python-e2e-test
58+
59+
integ-tests-with-docker-x86-64:
60+
make ARCH=x86_64 compile-with-docker
61+
make prep-python
62+
make TEST_ARCH=x86_64 TEST_PORT=8002 exec-python-e2e-test
63+
64+
integ-tests-with-docker-arm64:
65+
make ARCH=arm64 compile-with-docker
66+
make prep-python
67+
docker run --rm --privileged multiarch/qemu-user-static --reset -p yes
68+
make TEST_ARCH=arm64 TEST_PORT=9002 exec-python-e2e-test
69+
70+
integ-tests-with-docker-old:
71+
make ARCH=old compile-with-docker
72+
make prep-python
73+
make TEST_ARCH="" TEST_PORT=9052 exec-python-e2e-test
74+
75+
check-binaries: prep-python
76+
.venv/bin/pip install cve-bin-tool
77+
.venv/bin/python -m cve_bin_tool.cli bin/ -r go -d REDHAT,OSV,GAD,CURL --no-0-cve-report -f csv

‎cmd/aws-lambda-rie/handlers.go

+9
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,7 @@ package main
55

66
import (
77
"bytes"
8+
"encoding/base64"
89
"fmt"
910
"io/ioutil"
1011
"math"
@@ -81,6 +82,13 @@ func InvokeHandler(w http.ResponseWriter, r *http.Request, sandbox Sandbox, bs i
8182
return
8283
}
8384

85+
rawClientContext, err := base64.StdEncoding.DecodeString(r.Header.Get("X-Amz-Client-Context"))
86+
if err != nil {
87+
log.Errorf("Failed to decode X-Amz-Client-Context: %s", err)
88+
w.WriteHeader(500)
89+
return
90+
}
91+
8492
initDuration := ""
8593
inv := GetenvWithDefault("AWS_LAMBDA_FUNCTION_TIMEOUT", "300")
8694
timeoutDuration, _ := time.ParseDuration(inv + "s")
@@ -114,6 +122,7 @@ func InvokeHandler(w http.ResponseWriter, r *http.Request, sandbox Sandbox, bs i
114122
TraceID: r.Header.Get("X-Amzn-Trace-Id"),
115123
LambdaSegmentID: r.Header.Get("X-Amzn-Segment-Id"),
116124
Payload: bytes.NewReader(bodyBytes),
125+
ClientContext: string(rawClientContext),
117126
}
118127
fmt.Println("START RequestId: " + invokePayload.ID + " Version: " + functionVersion)
119128

‎go.mod

+7-7
Original file line numberDiff line numberDiff line change
@@ -1,20 +1,20 @@
11
module go.amzn.com
22

3-
go 1.20
3+
go 1.22
44

55
require (
6-
github.com/aws/aws-lambda-go v1.41.0
6+
github.com/aws/aws-lambda-go v1.46.0
77
github.com/aws/aws-sdk-go v1.44.62
88
github.com/aws/aws-xray-daemon v0.0.0-20230202010956-acaf06e9a638
99
github.com/cihub/seelog v0.0.0-20170130134532-f561c5e57575
1010
github.com/fsnotify/fsnotify v1.6.0
11-
github.com/go-chi/chi v4.1.2+incompatible
12-
github.com/google/uuid v1.3.0
11+
github.com/go-chi/chi v1.5.5
12+
github.com/google/uuid v1.6.0
1313
github.com/jessevdk/go-flags v1.5.0
1414
github.com/shirou/gopsutil v2.19.10+incompatible
1515
github.com/sirupsen/logrus v1.9.3
16-
github.com/stretchr/testify v1.8.4
17-
golang.org/x/sync v0.2.0
16+
github.com/stretchr/testify v1.9.0
17+
golang.org/x/sync v0.6.0
1818
golang.org/x/sys v0.14.0
1919
)
2020

@@ -24,7 +24,7 @@ require (
2424
github.com/go-ole/go-ole v1.2.4 // indirect
2525
github.com/jmespath/go-jmespath v0.4.0 // indirect
2626
github.com/pmezard/go-difflib v1.0.0 // indirect
27-
github.com/stretchr/objx v0.5.0 // indirect
27+
github.com/stretchr/objx v0.5.2 // indirect
2828
golang.org/x/net v0.18.0 // indirect
2929
golang.org/x/text v0.14.0 // indirect
3030
gopkg.in/yaml.v2 v2.2.8 // indirect

‎go.sum

+12-15
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
github.com/StackExchange/wmi v0.0.0-20190523213315-cbe66965904d h1:G0m3OIz70MZUWq3EgK3CesDbo8upS2Vm9/P3FtgI+Jk=
22
github.com/StackExchange/wmi v0.0.0-20190523213315-cbe66965904d/go.mod h1:3eOhrUMpNV+6aFIbp5/iudMxNCF27Vw2OZgy4xEx0Fg=
3-
github.com/aws/aws-lambda-go v1.41.0 h1:l/5fyVb6Ud9uYd411xdHZzSf2n86TakxzpvIoz7l+3Y=
4-
github.com/aws/aws-lambda-go v1.41.0/go.mod h1:jwFe2KmMsHmffA1X2R09hH6lFzJQxzI8qK17ewzbQMM=
3+
github.com/aws/aws-lambda-go v1.46.0 h1:UWVnvh2h2gecOlFhHQfIPQcD8pL/f7pVCutmFl+oXU8=
4+
github.com/aws/aws-lambda-go v1.46.0/go.mod h1:dpMpZgvWx5vuQJfBt0zqBha60q7Dd7RfgJv23DymV8A=
55
github.com/aws/aws-sdk-go v1.44.62 h1:N8qOPnBhl2ZCIFiqyB640Xt5CeX9D8CEVhG/Vj7jGJU=
66
github.com/aws/aws-sdk-go v1.44.62/go.mod h1:y4AeaBuwd2Lk+GepC1E9v0qOiTws0MIWAX4oIKwKHZo=
77
github.com/aws/aws-xray-daemon v0.0.0-20230202010956-acaf06e9a638 h1:G0C87W0m2uyh3uHV24Q60JJx+AyJ3//gJjalvSizXhc=
@@ -13,12 +13,12 @@ github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c
1313
github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
1414
github.com/fsnotify/fsnotify v1.6.0 h1:n+5WquG0fcWoWp6xPWfHdbskMCQaFnG6PfBrh1Ky4HY=
1515
github.com/fsnotify/fsnotify v1.6.0/go.mod h1:sl3t1tCWJFWoRz9R8WJCbQihKKwmorjAbSClcnxKAGw=
16-
github.com/go-chi/chi v4.1.2+incompatible h1:fGFk2Gmi/YKXk0OmGfBh0WgmN3XB8lVnEyNz34tQRec=
17-
github.com/go-chi/chi v4.1.2+incompatible/go.mod h1:eB3wogJHnLi3x/kFX2A+IbTBlXxmMeXJVKy9tTv1XzQ=
16+
github.com/go-chi/chi v1.5.5 h1:vOB/HbEMt9QqBqErz07QehcOKHaWFtuj87tTDVz2qXE=
17+
github.com/go-chi/chi v1.5.5/go.mod h1:C9JqLr3tIYjDOZpzn+BCuxY8z8vmca43EeMgyZt7irw=
1818
github.com/go-ole/go-ole v1.2.4 h1:nNBDSCOigTSiarFpYE9J/KtEA1IOW4CNeqT9TQDqCxI=
1919
github.com/go-ole/go-ole v1.2.4/go.mod h1:XCwSNxSkXRo4vlyPy93sltvi/qJq0jqQhjqQNIwKuxM=
20-
github.com/google/uuid v1.3.0 h1:t6JiXgmwXMjEs8VusXIJk2BXHsn+wx8BZdTaoZ5fu7I=
21-
github.com/google/uuid v1.3.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
20+
github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
21+
github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
2222
github.com/jessevdk/go-flags v1.5.0 h1:1jKYvbxEjfUl0fmqTCOfonvskHHXMjBySTLW4y9LFvc=
2323
github.com/jessevdk/go-flags v1.5.0/go.mod h1:Fw0T6WPc1dYxT4mKEZRfG5kJhaTDP9pj1c2EWnYs/m4=
2424
github.com/jmespath/go-jmespath v0.4.0 h1:BEgLn5cpjn8UN1mAw4NjwDrS35OdebyEtFe+9YPoQUg=
@@ -33,19 +33,16 @@ github.com/shirou/gopsutil v2.19.10+incompatible/go.mod h1:5b4v6he4MtMOwMlS0TUMT
3333
github.com/sirupsen/logrus v1.9.3 h1:dueUQJ1C2q9oE3F7wvmSGAaVtTmUizReu6fjN8uqzbQ=
3434
github.com/sirupsen/logrus v1.9.3/go.mod h1:naHLuLoDiP4jHNo9R0sCBMtWGeIprob74mVsIT4qYEQ=
3535
github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
36-
github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSSt89Yw=
37-
github.com/stretchr/objx v0.5.0 h1:1zr/of2m5FGMsad5YfcqgdqdWrIhu+EBEJRhR1U7z/c=
38-
github.com/stretchr/objx v0.5.0/go.mod h1:Yh+to48EsGEfYuaHDzXPcE3xhTkx73EhmCGUpEOglKo=
36+
github.com/stretchr/objx v0.5.2 h1:xuMeJ0Sdp5ZMRXx/aWO6RZxdr3beISkG5/G/aIRr3pY=
37+
github.com/stretchr/objx v0.5.2/go.mod h1:FRsXN1f5AsAjCGJKqEizvkpNtU+EGNCLh3NxZ/8L+MA=
3938
github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
40-
github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
41-
github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
42-
github.com/stretchr/testify v1.8.4 h1:CcVxjf3Q8PM0mHUKJCdn+eZZtm5yQwehR5yeSVQQcUk=
43-
github.com/stretchr/testify v1.8.4/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo=
39+
github.com/stretchr/testify v1.9.0 h1:HtqpIVDClZ4nwg75+f6Lvsy/wHu+3BoSGCbBAcpTsTg=
40+
github.com/stretchr/testify v1.9.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
4441
golang.org/x/net v0.0.0-20220127200216-cd36cc0744dd/go.mod h1:CfG3xpIq0wQ8r1q4Su4UZFWDARRcnwPjda9FqA0JpMk=
4542
golang.org/x/net v0.18.0 h1:mIYleuAkSbHh0tCv7RvjL3F6ZVbLjq4+R7zbOn3Kokg=
4643
golang.org/x/net v0.18.0/go.mod h1:/czyP5RqHAH4odGYxBJ1qz0+CE5WZ+2j1YgoEo8F2jQ=
47-
golang.org/x/sync v0.2.0 h1:PUR+T4wwASmuSTYdKjYHI5TD22Wy5ogLU5qZCOLxBrI=
48-
golang.org/x/sync v0.2.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
44+
golang.org/x/sync v0.6.0 h1:5BMeUDZ7vkXGfEr1x9B4bRcTH4lpkTkpdh0T/J+qjbQ=
45+
golang.org/x/sync v0.6.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
4946
golang.org/x/sys v0.0.0-20210320140829-1e4c9ba3b0c4/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
5047
golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
5148
golang.org/x/sys v0.0.0-20211216021012-1d35b9e2eb4e/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=

0 commit comments

Comments
 (0)