search

aws / aws-nitro-enclaves-cli

Tooling for Nitro Enclave Management
Apache License 2.0
124 stars 81 forks source link

Allow NITRO_CLI_INSTALL_DIR to be overriden in nitro-cli-env.sh #378

Closed stephenm-stripe closed 2 years ago

stephenm-stripe commented 2 years ago

Issue #, if available: N/A

Description of changes: Similar to https://github.com/aws/aws-nitro-enclaves-cli/pull/376, there are a few cases where NITRO_CLI_INSTALL_DIR is fixed to a particular path when it should be adjustable. In this case, when compiling aws-nitro-enclaves-cli, the makefile command 

sed -i "2 a NITRO_CLI_INSTALL_DIR=$$(readlink -f ${NITRO_CLI_INSTALL_DIR})" \
        ${NITRO_CLI_INSTALL_DIR}${ENV_SETUP_DIR}/nitro-cli-env.sh

injects the current NITRO_CLI_INSTALL_DIR value to the nitro-cli-env.sh file.

At Stripe, we compile aws-nitro-enclaves-cli from source in CI and later deploy the binaries and configuration files to live hosts. The NITRO_CLI_INSTALL_DIR is different in our CI systems than it is on our live hosts. For example, NITRO_CLI_INSTALL_DIR=/build/aws-nitro-enclaves-cli in CI and NITRO_CLI_INSTALL_DIR=/deploy on live hosts. We ran into the issue of the hardcoded NITRO_CLI_INSTALL_DIR variable on live hosts when trying to prepare running an Enclave on them.

To fix this, this PR modifies the injected statement to allow for an existing NITRO_CLI_INSTALL_DIR to be used instead. The prepared version of nitro-cli-env.sh now starts like:

#!/bin/bash

NITRO_CLI_INSTALL_DIR=${NITRO_CLI_INSTALL_DIR:-/build/aws-nitro-enclaves-cli}

This allows an existing NITRO_CLI_INSTALL_DIR to be respected, while maintaining a fallback to the build-time value if not set.

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.

petreeftime commented 2 years ago

Can you please a signature to the commit? git commit --amend -s