1
100%
master: 100%

Ran 16 Mar 2020 06:09AM UTC

Files 5

Run time 0s

Badge

Embed ▾

Committed 16 Mar 2020 05:59AM UTC coverage: 100.0%. First build

Job # TOX_ENV=cov-travis

Build Type

push

travis-ci

Committed by

rohanpm

Commit Message

Allow usage of dependencies secured by hash

Previously, the package produced by "tox -e package" did not
bundle any dependencies.  Although this worked, let's start
bundling dependencies instead, for a couple of reasons:

- It turns out this is actually the recommended practice even
  for deps such as boto3, despite the lambda runtime providing
  a copy of it; although there is much confusion on this point.
  See [1] for a discussion about this.

- If we don't bundle dependencies, then we have no way to roll
  back changes to those dependencies. This puts us at risk if
  the lambda runtime updates a dependency in a manner such that
  our code stops working.

- We'll likely want to introduce dependencies on some other
  packages owned by ourselves at some point, so let's figure out
  how to do that securely. Declaring dependencies with --hash
  seems to achieve this, and dependabot supports updating those
  automatically while maintaining hashes.

For that last point, the version of boto3 included here was
deliberately chosen as a slightly older release, so that we can
try having dependabot update the dependency.

[1] https://www.serverlessops.io/blog/aws-lambda-and-python-boto3-bundling

Run Details

39 of 39 relevant lines covered (100.0%)

1.0 hits per line

release-engineering / cdn-lambda / 40 / 1
100%
master: 100%

README BADGES
x

Markdown

Textile

RDoc

HTML

Rst

Source Files on job 40.1 (TOX_ENV=cov-travis)

release-engineering / cdn-lambda / 40 / 1 100% master: 100%

README BADGES x

Markdown

Textile

RDoc

HTML

Rst

Source Files on job 40.1 (TOX_ENV=cov-travis)

release-engineering / cdn-lambda / 40 / 1
100%
master: 100%

README BADGES
x