3 ms·
Not OP but I left another comment further up- I also run my Yum & Apt repo builds in containers and I have lambda launch those containers when S3 is updated...
by leetrout 10y ago
Not OP but I left another comment further up-
I also run my Yum & Apt repo builds in containers and I have lambda launch those containers when S3 is updated...
In order to facilitate signing I have my GPG key on the container host machine and mount that directory as a volume in the container so the container has access to the key as well.
For initially provisioning the container server I deploy the GPG key as an encrypted blob and decrypt it on the host.
- akerl_ 10y agoYup yup. I do similarly at the moment. I was brainstorming a bit more, I think if I were to port to Lambda, I'd probably use a KMS-encrypted S3 object to store the private key. That said, it would mean fixing up my original key strategy. At the moment, I'm using a signing subkey of my personal GPG key, since it's just a personal repo and I control the VM/container where the stuff happens. By comparison, if I were dropping it into a lambda/s3, I'd probably be more motivated to split onto a fully separate key for the repo.