Take a look at the brief write-up that shows how AWS signature authentication can be turn on for Nerves Firmware Updater (the Cowboy based micro HTTP service).
Would appreciate if someone with Nerves setup try this out and provide any feedback.
Here is the Github Wiki URL for the write-up:
It looks like this would require in-sync time clocks on the host machine and target. I’m developing several systems that do not rely on NTP being available on the target machine.
I could see this being very useful for systems that do require NTP however.
It might be interesting to go a PKI route for encrypting/decrypting the firmware. Which wouldn’t require the systems to be in sync.
Also the nerves team is working on a solution for this that would use a PKI system to mange signing at the Fwup level. https://github.com/nerves-project/nerves_firmware/pull/8
Anything beyond the pure signature verification is controlled by the service being protected. The purpose of pre_verification callback implementation is to hand off that responsibility to the actual implementation.
The implementation in the fork is calling a convenience function check_expiration. This function performs expiration check only when expiration time is included the request (X-Amz-Expires). If expiration is not included in the signed request, the request doesn’t expire.
You can replace that check_expiration call with something of your own. You can even remove it and not worry about the signing timestamp/expiration.
In fact, the actual callback name is pre_verification. What goes on in that callback is upto the implementaion.
Hope that clarifies.
© Copyright Elixir Forum | Terms | Privacy & Cookies
