thought-machine / falco-probes

Automated build and mirror of eBPF kernel probes for use as a driver with the Falco runtime security agent (https://falco.org/)
Apache License 2.0
16 stars 4 forks source link

Determine whether a given Kernel Package name has been uploaded to the repository already #15

Closed VJftw closed 3 years ago

VJftw commented 3 years ago

Our initial implementation of checking if a kernel probe is already uploaded is performed quite late in the build process as we have to obtain the KernelPackage including its sources in order to get the kernel probe name. This doesn't really save us much time and means our builds are still quite resource intensive and long as they download a KernelPackage's sources each time.

Ideally, we can move this earlier in the process, to once we've obtained the list of KernelPackage names (operatingsystem.OperatingSystem.GetKernelPackageNames()) we can verify if a given KernelPackage name is already uploaded to the repository. In order to do this, we could store a mapping of Kernel Package Name -> Kernel Probe name in the release notes. e.g. Kernel Package Probe
4.14.101-91.76.amzn2 falco_amazonlinux2_4.14.101-91.76.amzn2.x86_64_1.o

We could then use this mapping in our tooling to verify if we already have a Release asset of Probe for the given Kernel Package.

sHesl commented 3 years ago

Happy to take a look at this if no-one else is picking this up.

Guessing we want something like:

VJftw commented 3 years ago

Yes, please! I hadn't put much thought into it, but what you've suggested sounds 💯 . I'm beginning to lean a bit more towards the full generation way to start with in order to reduce our requests to the GitHub APIs as we're hitting limits at the moment (1000/hour).