Skip to content

Conversation

@hwei0
Copy link
Member

@hwei0 hwei0 commented Dec 17, 2025

Issue #, if available:
#82

Description of changes:

added custom --version output to publish boto3, botocore git tag+commit+data hash (data hash is the hash of the simplified data files). This information will only be exposed if the hidden --debug flag is set; current --version behaviour without the --deubg flag will remain unchanged.

example output

./target/debug/iam-policy-autopilot --version --debug
0.1.2
boto3 version: commit_id=0ca53211df7d2bb2213436a6b19e8cf0b44dee7d, commit_tag=1.42.11, data_hash=8309474F524E2F3DE2F90ADA66F1C5C887358CC503846073663BA311783FF495
botocore version: commit_id=7c770fb210913ff9fa9b35470161c3278786085b, commit_tag=None, data_hash=615E77E2C8C1DD6FD471416D712F4FE5A8E66B45150DC5D4BDC192736A8A42F1

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.

iam_policy_autopilot_policy_generation::api::get_botocore_version_info()?;
println!("{}", crate_version!());
println!(
"boto3 version: commit_id={}, commit_tag={}, data_hash={}",
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Q: is this something we'd want to expose to customers?

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We could have a separate command which we hide, that is easier to parse, it could output JSON.

Copy link
Member Author

@hwei0 hwei0 Dec 19, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

ack, i'll make a new --debug hidden flag to do this.

i'm against JSON for now (easier to parse line-by-line with sed and | head -n X | tail -n 1), but if we want JSON we can revisit later.

Cargo.toml Outdated
chrono = { version = "0.4", features = ["serde"] }
uuid = { version = "1.8", features = ["v4"] }
sha2 = "0.10"
sha2 = "0.10.9"
Copy link
Contributor

@mschlaipfer mschlaipfer Dec 18, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think this is causing the OpenSSL build issue. We use rustls-tls in the reqwest dependency to work around a similar issue. I wonder if using use https://docs.rs/aws-lc-rs/1.15.2/aws_lc_rs/digest/fn.digest.html here would resolve the error?

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

seems like aws-lc-rs also failed the build for the same reason 💀

i resolved the build failure by adding the following to Cargo.toml depencies:

openssl = { version = "0.10", features = ["vendored"] }

@mschlaipfer
Copy link
Contributor

The PR title will need a chore: or feat: so it gets merged correctly (I don't think we have the PR title check, which should block merging this, yet).

Comment on lines +36 to +39
#[derive(RustEmbed)]
#[folder = "target/submodule-version-info"]
#[include = "*.json"]
struct GitSubmoduleVersionInfoRaw;
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

You could avoid embedding this data and parsing it in JSON by using the rustc-env instruction in the build script: https://doc.rust-lang.org/cargo/reference/build-scripts.html#rustc-env - You'd only need to set the environment variables (e.g., BOTO3_SUBMODULE_TAG`) to whatever you compute in the script, then extract them here.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

i see, that's good to know for the future. I'm opposed to doing that here since there's six such tag/hash/commit values, which might justify putting them in an embed struct instead.

@hwei0 hwei0 changed the title add submodule version+data hash info to --version output add submodule version+data hash info to --version --debug output Jan 5, 2026
let mut dir_entry_list = fs::read_dir(cwd)?
.map(|res| res.map(|e| e.path()))
.collect::<Result<Vec<_>, io::Error>>()?;
dir_entry_list.sort();
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Q: why is this necessary?

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The sha computation recurses the contents of the simplified boto3 and botocore subdirectories, and the ordering of this recursion affects the computed checksum. So the ordering of the recursion needs to be deterministic to make the hash deterministic.

@weibenz1
Copy link
Contributor

weibenz1 commented Jan 6, 2026

The PR title will need a chore: or feat: so it gets merged correctly (I don't think we have the PR title check, which should block merging this, yet).

don't forget about this

@hwei0 hwei0 changed the title add submodule version+data hash info to --version --debug output feat: add submodule version+data hash info to --version --debug output Jan 6, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants