Overview · epmog/.github · GitHub

Security

SECURITY.md

Reporting Security Issues

Amazon Web Services (AWS) is dedicated to the responsible disclosure of security vulnerabilities.

We kindly ask that you do not open a public GitHub issue to report security concerns.

Instead, please submit the issue to the AWS Vulnerability Disclosure Program via HackerOne or send your report via email.

For more details, visit the AWS Vulnerability Reporting Page.

Thank you in advance for collaborating with us to help protect our customers.

OpenPGP Keys for AWS Deadline Cloud

Current Keys

Select the "Copy" icon to copy the following key:

Historical Keys

Verifying GitHub Releases

You can verify the authenticity of the release artifacts using the gpg command line tool.

Download the desired release artifacts from the GitHub releases page. Make sure to download the corresponding PGP signature file (ending with .sig) as well. For example, if you would like to verify your download of the wheel for version x.x.x, you should have the following files downloaded:
```
<package>-x.x.x-py3-none-any.whl
<package>-x.x.x-py3-none-any.whl.sig
```
Install the gpg command line tool. The installation process varies by operating system. Please refer to the GnuPG website for instructions: https://gnupg.org/download/
Save the OpenPGP key from the OpenPGP Keys for AWS Deadline Cloud section above to a file called awsdeadlinecloud-pgp.asc.

Import the OpenPGP key for AWS Deadline Cloud by running the following command:

gpg --import --armor awsdeadlinecloud-pgp.asc

Response:

gpg: key ################: public key "AWS Deadline Cloud <aws-deadline@amazon.com>" imported

Determine whether to trust the OpenPGP key. Some factors to consider when deciding whether or not to trust the above key are:

The internet connection you’ve used to obtain the GPG key from this website is secure
The device that you are accessing this website on is secure

If you have decided to trust the OpenPGP key, then edit the key to trust with gpg like the following example:

$ gpg --edit-key **<replace with 16 character key from step 4>**
gpg (GnuPG) 2.0.22; Copyright (C) 2013 Free Software Foundation, Inc.
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.


pub  4096R/4BF0B8D2  created: 2023-06-23  expires: 2025-06-22  usage: SCEA
                     trust: unknown       validity: unknown
[ unknown] (1). AWS Deadline Cloud example@example.com

gpg> trust
pub  4096R/4BF0B8D2  created: 2023-06-23  expires: 2025-06-22  usage: SCEA
                     trust: unknown       validity: unknown
[ unknown] (1). AWS Deadline Cloud aws-deadline@amazon.com

Please decide how far you trust this user to correctly verify other users' keys
(by looking at passports, checking fingerprints from different sources, etc.)

  1 = I don't know or won't say
  2 = I do NOT trust
  3 = I trust marginally
  4 = I trust fully
  5 = I trust ultimately
  m = back to the main menu

Your decision? 5
Do you really want to set this key to ultimate trust? (y/N) y

pub  4096R/4BF0B8D2  created: 2023-06-23  expires: 2025-06-22  usage: SCEA
                     trust: ultimate      validity: unknown
[ unknown] (1). AWS Deadline Cloud aws-deadline@amazon.com
Please note that the shown key validity is not necessarily correct
unless you restart the program.

gpg> quit

Verify the signature of the an AWS Deadline Cloud release via gpg --verify. The command for verifying the example files from step 1 would be:
```
gpg --verify ./<package>-x.x.x-py3-none-any.whl.sig ./<package>-x.x.x-py3-none-any.whl
```