3 ms·
It's quite a clean extension that can be disabled at compile time. It doesn't complicate the rest of curl, and provides a useful way to invoke any AWS API from
by Scaevolus 2y ago
It's quite a clean extension that can be disabled at compile time. It doesn't complicate the rest of curl, and provides a useful way to invoke any AWS API from the CLI without needing a giant AWS library dependency.
It's well worth a thousand lines of code.
https://github.com/curl/curl/blob/b9fea261e632b9493ea6038bfb3da6075909cc39/lib/http_aws_sigv4.c https://github.com/curl/curl/blob/b9fea261e632b9493ea6038bfb...
- lopkeny12ko 2y agoAs an open source maintainer, this is what I would consider a slippery slope. Sure, this one is well-specified and "not that complex" until N years later there are 30 compile-time flags for all sorts of vendor-specific features and a new CVE every week from the massive increase in highly-use-case-specific code to maintain.
- matt-attack 2y agoI’m not that familiar with AWS innards. Can you explain how this one flag can access any API?
- Scaevolus 2y agoAWS uses one algorithm to authenticate requests against all of its APIs. Many of its APIs accept simple query parameters or JSON, making them easy to call with curl. https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_aws-signing.html https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_a...