40
100%
master: 100%

Ran 16 Mar 2020 06:09AM UTC

Jobs 1

Files 5

Run time 1s

Badge

Embed ▾

pending completion

Build # 40

Build Type

push

travis-ci

Committed by

rohanpm

Commit Message

Allow usage of dependencies secured by hash

Previously, the package produced by "tox -e package" did not
bundle any dependencies.  Although this worked, let's start
bundling dependencies instead, for a couple of reasons:

- It turns out this is actually the recommended practice even
  for deps such as boto3, despite the lambda runtime providing
  a copy of it; although there is much confusion on this point.
  See [1] for a discussion about this.

- If we don't bundle dependencies, then we have no way to roll
  back changes to those dependencies. This puts us at risk if
  the lambda runtime updates a dependency in a manner such that
  our code stops working.

- We'll likely want to introduce dependencies on some other
  packages owned by ourselves at some point, so let's figure out
  how to do that securely. Declaring dependencies with --hash
  seems to achieve this, and dependabot supports updating those
  automatically while maintaining hashes.

For that last point, the version of boto3 included here was
deliberately chosen as a slightly older release, so that we can
try having dependabot update the dependency.

[1] https://www.serverlessops.io/blog/aws-lambda-and-python-boto3-bundling

Run Details

39 of 39 relevant lines covered (100.0%)

1.0 hits per line

Jobs

ID	Job ID	Ran	Files	Coverage
1	40.1 (TOX_ENV=cov-travis)	16 Mar 2020 06:09AM UTC	0	100.0	Travis Job 40.1

Source Files on build 40

Detailed source file information is not available for this build.

release-engineering / cdn-lambda / 40
100%
master: 100%

README BADGES
x

Markdown

Textile

RDoc

HTML

Rst

Jobs

Source Files on build 40

release-engineering / cdn-lambda / 40 100% master: 100%

README BADGES x

Markdown

Textile

RDoc

HTML

Rst

Jobs

Source Files on build 40

release-engineering / cdn-lambda / 40
100%
master: 100%

README BADGES
x