search

seporaitis / yum-s3-iam

Yum package manager plugin for private S3 repositories. Uses Amazon IAM & EC2 Roles.
Apache License 2.0
162 stars 99 forks source link

yum check-update --security command is not being handled by s3iam plugin #85

Open LogeshGovi opened 4 years ago

LogeshGovi commented 4 years ago

Hi, I am really happy that you guys have decided to keep the project alive! I am using this plugin for self-hosted repos in S3 bucket. I have created the repo for amazonlinux and amazonlinux2, both being ports of CentOs. With regards to install, check-update commands the plugin is doing great by generating hmac signatures and adding them to yum http requests. However, when I do the yum check-update --security or yum update --security the requests are not being handled by the plugin. I have analysed the packets that are being sent to backend when these commands are executed. They are being directly sent as ordinary http requests without hmac signatures to the s3 url resulting in HTTP Error 403 Forbidden which is of course not a surprise. Any info in this regard will be really helpful. Thank you

seporaitis commented 4 years ago

Thank you for the submission. I will have time to look at this at the weekend/early next week.

seporaitis commented 4 years ago

I am aware that I did not come to look at this. Have been physically afk this whole weekend, so current ETA is next weekend.

LogeshGovi commented 4 years ago

Hi,I also didn't have the time to look into the yum code base this week. I will try to see if I can find something that might be helpful this weekend.

seporaitis commented 4 years ago

I had a brief look at the yum-plugin-security source code here (possibly a mirror, not sure where the official repo is), and it seems that it is using an unofficial way to list packages before filtering them. I am not yet confirmed that, but at the this is what I'll be trying to verify.