λgitsite

~ober/jerboa-aws

Imported from ~/mine/jerboa-aws

download snapshot

about

# jerboa-aws

`jerboa-aws` is an experimental AWS API client library and CLI for Jerboa. It
supports SigV4-signed requests across S3, EC2, IAM, STS, Lambda, CloudWatch,
CloudFormation, DynamoDB, SNS, SQS, SSM, RDS, ELBv2, and related services.

## Status

This repository is not production-supported yet. Treat it as a private/preview
tool until the release gates in `~/Release-plan.md` and
`~/mine/jerboa-production-readiness.md` are complete.

## Security

`jerboa-aws` handles AWS access keys, secret keys, session tokens, signed
requests, resource metadata, and service responses. Use short-lived role or SSO
credentials where possible, avoid long-lived IAM user keys, and do not pass
secrets in argv on shared systems.

Custom S3 endpoints require HTTPS. Plain HTTP exists only for local integration
tests and requires all three of a canonical `127.x.y.z` literal, path-style
addressing, and the explicit `allow-insecure-loopback:` constructor flag. The
HTTP client returns redirects to the caller and never forwards signed headers
or session tokens to a redirect target.

Use `jerboa-aws ssm put-parameter --value-stdin` for parameter values,
especially `SecureString`; the legacy `--value` form warns for secure values.
PSSM strips remote terminal controls in human output, supports
`--literal-controls` for visible `\xNN` rendering, and honors `--no-color`.
Use `--json` when lossless remote output is required.

`jerboa-aws ssmcp` and `jerboa-aws ssm cp` recursively copy with
`host:path` syntax: `host:~/save ./foo` downloads and `./foo host:/tmp/foo`
uploads through SSM RunCommand using tar/base64 chunks. Targets must already
have the SSM agent plus `sh`, `tar`, `base64`, `mkdir`, and `find`.

Credential handling, logging expectations, and release requirements are
documented in [`docs/credential-handling.md`](docs/credential-handling.md).
SigV4 signing uses Jerboa's bundled Rust-backed native crypto; see
[`docs/crypto-dependencies.md`](docs/crypto-dependencies.md).

## Build And Test

```sh
make test
make binary
make release-evidence
```

The Makefile bootstraps a pinned Jerboa toolchain into `.jerboa/bin` if no
usable `jerbuild` is available.

Release evidence is written to `dist/release-evidence/` and includes tests,
binary smoke output, SBOM/dependency manifests, `cargo audit` status when
available, and repeated binary reproducibility checks.

## License

Apache-2.0.

recent commits