tuf repo canary: Adds canary client, dockerfile, cloudformation template #490

etungsten · 2019-11-07T20:01:40Z

Issue #, if available: Fixes #456

Description of changes:
Adds repo-canary client for retrieving & validating TUF repo metadata files and listed target files

Adds Dockerfile for building the repo-canary container image. Currently just directly mapping in the repo-canary client binary and the trusted root.json.

Adds Cloudformation template for setting up the TUF repo canary task, rules, alarms

Testing:

To build the tuf-repo-canary image, the repo-canary binary needs to first be built: cargo install --path . --force
And the metadata url and targets url need to be specified through build-args:

docker build --network=host --build-arg METADATA_BASE_URL=https://d25d9m6x9pxh9h.cloudfront.net/45efedef4afe/metadata/ --build-arg TARGET_BASE_URL=https://d25d9m6x9pxh9h.cloudfront.net/45efedef4afe/targets/  -t tuf-repo-canary .

Tested repo-canary locally and the sampled targets are reasonably random:

$ sudo ./target/release/repo-canary --metadata-base-url https://d25d9m6x9pxh9h.cloudfront.net/45efedef4afe/metadata/ --target-base-url https://d25d9m6x9pxh9h.cloudfront.net/45efedef4afe/targets/ --percentage-of-targets-to-retrieve 15
21:08:14 [ INFO] Loading TUF repo
21:08:14 [ INFO] Loaded TUF repo
21:08:14 [ INFO] Downloading 15% of listed targets
21:08:14 [ INFO] Downloading target: thar-x86_64-root.ext4.lz4
21:08:58 [ INFO] Downloading target: thar-x86_64-0.1.5-root.ext4.lz4
21:09:18 [ INFO] Downloading target: thar-x86_64-0.1.6-root.verity.lz4
$ sudo ./target/release/repo-canary --metadata-base-url https://d25d9m6x9pxh9h.cloudfront.net/45efedef4afe/metadata/ --target-base-url https://d25d9m6x9pxh9h.cloudfront.net/45efedef4afe/targets/ --percentage-of-targets-to-retrieve 15
21:09:20 [ INFO] Loading TUF repo
21:09:20 [ INFO] Loaded TUF repo
21:09:20 [ INFO] Downloading 15% of listed targets
21:09:21 [ INFO] Downloading target: thar-x86_64-0.2.1-root.ext4.lz4
21:09:35 [ INFO] Downloading target: thar-x86_64-0.1.4-boot.ext4.lz4
21:09:36 [ INFO] Downloading target: thar-x86_64-0.2.1-root.verity.lz4
$ sudo ./target/release/repo-canary --metadata-base-url https://d25d9m6x9pxh9h.cloudfront.net/45efedef4afe/metadata/ --target-base-url https://d25d9m6x9pxh9h.cloudfront.net/45efedef4afe/targets/ --percentage-of-targets-to-retrieve 15
21:09:41 [ INFO] Loading TUF repo
21:09:41 [ INFO] Loaded TUF repo
21:09:41 [ INFO] Downloading 15% of listed targets
21:09:41 [ INFO] Downloading target: thar-x86_64-0.1.5-boot.ext4.lz4
21:09:43 [ INFO] Downloading target: thar-x86_64-0.1.6-root.verity.lz4
21:09:43 [ INFO] Downloading target: thar-x86_64-0.2.1-root.verity.lz4
$ sudo ./target/release/repo-canary --metadata-base-url https://d25d9m6x9pxh9h.cloudfront.net/45efedef4afe/metadata/ --target-base-url https://d25d9m6x9pxh9h.cloudfront.net/45efedef4afe/targets/ --percentage-of-targets-to-retrieve 15
21:09:47 [ INFO] Loading TUF repo
21:09:48 [ INFO] Loaded TUF repo
21:09:48 [ INFO] Downloading 15% of listed targets
21:09:48 [ INFO] Downloading target: thar-x86_64-0.1.6-boot.ext4.lz4
21:09:49 [ INFO] Downloading target: thar-x86_64-0.1.4-root.verity.lz4
21:09:50 [ INFO] Downloading target: thar-x86_64-0.1.4-boot.ext4.lz4
$ sudo ./target/release/repo-canary --metadata-base-url https://d25d9m6x9pxh9h.cloudfront.net/45efedef4afe/metadata/ --target-base-url https://d25d9m6x9pxh9h.cloudfront.net/45efedef4afe/targets/ --percentage-of-targets-to-retrieve 15
21:09:52 [ INFO] Loading TUF repo
21:09:53 [ INFO] Loaded TUF repo
21:09:53 [ INFO] Downloading 15% of listed targets
21:09:53 [ INFO] Downloading target: thar-x86_64-0.1.6-boot.ext4.lz4
21:09:53 [ INFO] Downloading target: manifest.json
21:09:53 [ INFO] Downloading target: thar-x86_64-0.2.1-root.ext4.lz4

Tested the Cloudformation stack and verified alarms by triggering alarms manually.

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.

sam-aws · 2019-11-07T22:14:03Z

extras/repo-canary/src/main.rs

+}
+
+/// Retrieves all targets listed in the TUF repo and monitor for any errors
+fn retrieve_all_targets(repo: &Repository<'_>) -> Result<()> {


As a side note, this could become a relatively expensive operation in the future. Our TUF repo is already about 1GB. Not a problem at the moment but depending on where or how often this canary is running maybe we should look at doing incremental checks as well.

Tried addressing this with a new --percentage-of-targets-to-retrieve option.

extras/repo-canary/src/main.rs

etungsten · 2019-11-08T01:49:00Z

Addresses subset of @sam-aws 's comments:

Adds new option to repo-canary: --percentage-of-targets-to-retrieve that specifies percentage of target files to randomly sample and retrieve. Currently setting it to 50% of the targets.

etungsten · 2019-11-08T18:17:11Z

Addresses @zmrow 's comment.

Updated so there's only one explicit call to process::exit from main()

extras/repo-canary/src/main.rs

etungsten · 2019-11-08T20:32:22Z

Addresses @iliana 's comments.

Representing custom exit codes via constants.

zmrow

Just a few comments!

I like the cleanup of the exit codes!

extras/repo-canary/src/main.rs

infra/tuf-repo-canary/RepoCanary.template.yaml

extras/repo-canary/src/main.rs

zmrow

🦃

etungsten · 2019-11-08T21:57:58Z

Adds a new cloudwatch alarm for actually monitoring for task start failures (e.g. no memory, failed to pull container from ECR) and not just invocation failures (IAM role permission issues).

iliana · 2019-11-08T21:59:25Z

Just merged #496 with the error variant rename I mentioned in IRC, so you'll want to rebase.

etungsten · 2019-11-08T22:45:37Z

Rebase develop to bring in new tough changes.

Also adds separate log groups for different event rules.

etungsten · 2019-11-09T00:10:08Z

Fixed some cloudformation event rules that weren't logging anything :/

Gah! Had a typo. Fixed typo in the push below

etungsten · 2019-11-09T17:33:06Z

Referencing tough library directly from crates.io
Updated Dockerfile to build repo-canary binary for the TUF repo canary
Clean up unneeded dependencies in Cargo.toml

zmrow

🔍

etungsten · 2019-11-11T22:02:58Z

Updated the period of the event rules to every 10 minutes

Adds repo-canary client for validating TUF repo metadata files and downloads all listed targets. Adds Dockerfile for building the repo-canary container image Adds cloudformation template for setting up the TUF repo canary task, rules, alarms

etungsten · 2019-11-11T23:07:18Z

Relocated the infra folder to under `tools/

etungsten force-pushed the tuf-repo-canary branch from d5cff5d to 48b0fa6 Compare November 7, 2019 20:02

etungsten assigned etungsten and zmrow and unassigned etungsten and zmrow Nov 7, 2019

etungsten requested a review from zmrow November 7, 2019 20:07

zmrow requested review from iliana and sam-aws November 7, 2019 22:04

sam-aws reviewed Nov 7, 2019

View reviewed changes

extras/repo-canary/src/main.rs Outdated Show resolved Hide resolved

etungsten force-pushed the tuf-repo-canary branch from 48b0fa6 to 366f587 Compare November 8, 2019 01:42

etungsten force-pushed the tuf-repo-canary branch 2 times, most recently from befa1a3 to 4d99742 Compare November 8, 2019 18:16

iliana approved these changes Nov 8, 2019

View reviewed changes

extras/repo-canary/src/main.rs Outdated Show resolved Hide resolved

extras/repo-canary/src/main.rs Outdated Show resolved Hide resolved

etungsten force-pushed the tuf-repo-canary branch from 4d99742 to ae05cfa Compare November 8, 2019 20:31

zmrow reviewed Nov 8, 2019

View reviewed changes

zmrow approved these changes Nov 8, 2019

View reviewed changes

etungsten force-pushed the tuf-repo-canary branch from ae05cfa to c3a4326 Compare November 8, 2019 21:56

etungsten marked this pull request as ready for review November 8, 2019 21:56

etungsten force-pushed the tuf-repo-canary branch from c3a4326 to 71f5a3b Compare November 8, 2019 22:42

etungsten force-pushed the tuf-repo-canary branch 2 times, most recently from 577bd8b to 2c5dca0 Compare November 9, 2019 00:09

etungsten force-pushed the tuf-repo-canary branch from 2c5dca0 to cb3e884 Compare November 9, 2019 00:13

etungsten force-pushed the tuf-repo-canary branch 2 times, most recently from e0e1127 to 4a997ff Compare November 9, 2019 17:30

zmrow approved these changes Nov 11, 2019

View reviewed changes

etungsten force-pushed the tuf-repo-canary branch from 4a997ff to 6fd08d1 Compare November 11, 2019 22:02

etungsten force-pushed the tuf-repo-canary branch from 6fd08d1 to 6844fb6 Compare November 11, 2019 22:07

etungsten force-pushed the tuf-repo-canary branch from 6844fb6 to aee03c0 Compare November 11, 2019 23:06

sam-aws approved these changes Nov 11, 2019

View reviewed changes

etungsten merged commit 3cc9e45 into develop Nov 11, 2019

etungsten deleted the tuf-repo-canary branch November 11, 2019 23:13

iliana added this to the v0.2.0 milestone Nov 19, 2019

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

tuf repo canary: Adds canary client, dockerfile, cloudformation template #490

tuf repo canary: Adds canary client, dockerfile, cloudformation template #490

etungsten commented Nov 7, 2019 •

edited

sam-aws Nov 7, 2019

etungsten Nov 8, 2019

etungsten commented Nov 8, 2019

etungsten commented Nov 8, 2019

etungsten commented Nov 8, 2019

zmrow left a comment

zmrow left a comment

etungsten commented Nov 8, 2019

iliana commented Nov 8, 2019

etungsten commented Nov 8, 2019

etungsten commented Nov 9, 2019 •

edited

etungsten commented Nov 9, 2019

zmrow left a comment

etungsten commented Nov 11, 2019 •

edited

etungsten commented Nov 11, 2019

tuf repo canary: Adds canary client, dockerfile, cloudformation template #490

tuf repo canary: Adds canary client, dockerfile, cloudformation template #490

Conversation

etungsten commented Nov 7, 2019 • edited

sam-aws Nov 7, 2019

Choose a reason for hiding this comment

etungsten Nov 8, 2019

Choose a reason for hiding this comment

etungsten commented Nov 8, 2019

etungsten commented Nov 8, 2019

etungsten commented Nov 8, 2019

zmrow left a comment

Choose a reason for hiding this comment

zmrow left a comment

Choose a reason for hiding this comment

etungsten commented Nov 8, 2019

iliana commented Nov 8, 2019

etungsten commented Nov 8, 2019

etungsten commented Nov 9, 2019 • edited

etungsten commented Nov 9, 2019

zmrow left a comment

Choose a reason for hiding this comment

etungsten commented Nov 11, 2019 • edited

etungsten commented Nov 11, 2019

etungsten commented Nov 7, 2019 •

edited

etungsten commented Nov 9, 2019 •

edited

etungsten commented Nov 11, 2019 •

edited