AWS m2 high security documentation change
Summary
Replaced tar.gz with zip files, added digital signature verification instructions, removed CVE reports and checksums
Security assessment
The addition of digital signature verification (via jarsigner) directly addresses security by ensuring artifact authenticity and integrity. This mitigates risks of tampering or malicious code injection. The removal of checksums in favor of stronger signature validation is a security improvement.
Diff
diff --git a/m2/latest/userguide/ba-runtime-artifacts.md b/m2/latest/userguide/ba-runtime-artifacts.md index 92f2697db..c06eeb6ba 100644 --- a//m2/latest/userguide/ba-runtime-artifacts.md +++ b//m2/latest/userguide/ba-runtime-artifacts.md @@ -35 +35 @@ In both Release and Pre-release buckets, you'll find: -**aws-bluage-runtime-x.y.z.tar.gz** +**aws-bluage-runtime-x.y.z.zip** @@ -48 +48 @@ This archive, where x.y.z represents the version number (`major.minor.patch` as -**aws-bluage-webapps-x.y.z.tar.gz** +**aws-bluage-webapps-x.y.z.zip** @@ -61 +61 @@ This archive, where x.y.z follows the same versioning scheme as above, includes -### Additional files +### Package Signature Verification @@ -63 +63 @@ This archive, where x.y.z follows the same versioning scheme as above, includes - * Checksum files that let you verify integrity for both Blu Age archives following the naming convention: +The released zip files are provided as digitally signed ZIP archives to ensure security and authenticity. Digital signatures help verify that the files you download are genuine, unaltered, and officially released by our organization. This prevents tampering and protects against malware or compromised files that could be maliciously distributed. @@ -65 +65 @@ This archive, where x.y.z follows the same versioning scheme as above, includes - * For Runtime: `aws-bluage-runtime-x.y.z.tar.gz.checksumSHA256` +To verify the signature of the ZIP file before using it, you can use the following command: @@ -67,7 +67 @@ This archive, where x.y.z follows the same versioning scheme as above, includes - * For Webapps: `aws-bluage-webapps-x.y.z.tar.gz.checksumSHA256` - - * CVE report files (For the release versions only) list the present CVEs on this version and follow the naming convention: - - * For Runtime: `Bluage-Runtime-x.y.z-CVEs.txt` - - * For Webapps: `Bluage-Webapps-x.y.z-CVEs.txt` +`jarsigner -verify -certs -verbose aws-bluage-runtime-x.y.z.zip` @@ -74,0 +69 @@ This archive, where x.y.z follows the same versioning scheme as above, includes +Here the result example for a cerfified file : @@ -76,0 +72,2 @@ This archive, where x.y.z follows the same versioning scheme as above, includes + ... + jar verified. @@ -82 +79 @@ For details on how security vulnerabilities are addressed, see [AWS Mainframe Mo -While we strive to release our products without CVEs, new CVEs may appear later on. The CVE report file is updated regularly to reflect the latest status. +While we strive to release our products without CVEs, new CVEs may appear later on. @@ -94 +91 @@ The main bucket for the Developer Runtime is: `s3://toolbox-dev-runtime` -For more detailed information on requesting access and understanding the bucket structure, see [Dev and Special AWS Blu Age Runtimes](https://bluinsights.aws/docs/dev-special-bluage-runtime) documentation. +For more detailed information on requesting access see [Blu Age Toolbox](https://bluinsights.aws/docs/bluage-toolbox-introduction) documentation. @@ -100 +97 @@ Developer runtime artifacts typically include: -**gapwalk-x.y.z-dev.tar.gz** +**gapwalk-x.y.z.zip** @@ -104,8 +100,0 @@ This archive contains the development version of the Gapwalk component, which is -**gapwalk-runtime-x.y.z-javadoc.zip** - -This zip file contains the JavaDoc documentation for the Gapwalk runtime. JavaDoc provides detailed API documentation, which is especially useful for developers working on integrating or extending the Gapwalk runtime. - -**gapwalk-webapps-x.y.z-javadoc.zip** - -Similar to the runtime JavaDoc, this zip file contains the JavaDoc documentation specifically for the Gapwalk web applications. This documentation is crucial for developers working with or customizing the web-based components of the Gapwalk system. -