AWS cli: AWS CLI update: document --skip-signature-verification risk
Summary
Documents the new --skip-signature-verification flag for the CLI self-update command, explicitly warning that it disables verification of the install script's authenticity and noting the equivalent AWS_CLI_INSTALL_SKIP_SIGNATURE_VERIFICATION env var.
Security assessment
The change documents a flag that bypasses signature verification of the downloaded install script (supply-chain integrity control) and warns against its use; it is security guidance about a control-disabling option rather than a fix for a specific vulnerability.
Evidence
+`--skip-signature-verification` (boolean) Skip signature verification of the downloaded install script. NOT RECOMMENDED: this disables a security control that confirms the install script is authentic before it is run. Only use it if you understand and accept the risk (for example, when gpg is unavailable on Linux and cannot be installed). Setting the AWS_CLI_INSTALL_SKIP_SIGNATURE_VERIFICATION environment variable to “true” does the same.
Diff
diff --git a/cli/latest/reference/update/index.md b/cli/latest/reference/update/index.md index 77b9b53..4db5e8f 100644 --- a//cli/latest/reference/update/index.md +++ b//cli/latest/reference/update/index.md @@ -15 +15 @@ - * [AWS CLI 2.38.1 Command Reference](../../index.html) » + * [AWS CLI 2.38.2 Command Reference](../../index.html) » @@ -69 +69 @@ Note that `update` is only supported if the current CLI instance was installed u -_None_ +`--skip-signature-verification` (boolean) Skip signature verification of the downloaded install script. NOT RECOMMENDED: this disables a security control that confirms the install script is authentic before it is run. Only use it if you understand and accept the risk (for example, when gpg is unavailable on Linux and cannot be installed). Setting the AWS_CLI_INSTALL_SKIP_SIGNATURE_VERIFICATION environment variable to “true” does the same. @@ -188 +188 @@ The formatting style for error output. By default, errors are displayed in enhan - * [AWS CLI 2.38.1 Command Reference](../../index.html) » + * [AWS CLI 2.38.2 Command Reference](../../index.html) »