Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat(telemetry): add wasm-tools wasm binary annotations #1016

Merged
merged 60 commits into from
Oct 31, 2023

Conversation

Integralist
Copy link
Collaborator

@Integralist Integralist commented Sep 20, 2023

The intention is for this PR to be merged before #1013. Once this PR is merged (read: merged but NOT released), then the latter PR can be hooked into the metadata collection flows.

Context

Ultimately if we did publish both this PR and the latter as part of a new CLI release, they would still not collect any data yet as the annotations (which are part of this PR) are locked down to a feature flag to prevent users from accidentally sending metadata without the proper/appropriate consent.

Also worth noting there is nothing on the Fastly platform side to actually consume this metadata, so nothing would be 'analysed' until appropriate communications had been sent out and users given adequate time to adjust to the upcoming CLI release.

Although the metadata collection is behind a feature flag, this PR does still support disabling all metadata using an environment variable FASTLY_WASM_METADATA_DISABLE=true. This is just to be prepared for an eventual CLI release where the metadata collection becomes opt-out and so this will be required for adding to CI environments like the Fastly Compute Actions repo that customers use for installing the CLI and compiling/deploying Compute projects.

There should be a third PR at some point to remove the feature flag, so that the annotations are dependent solely on the user configuring their consent/non-consent via fastly compute metadata (which is implemented in the latter PR).

Screenshots

The following screenshot shows the default metadata on a compiled Wasm binary (i.e. metadata HAS NOT been enabled)...

Screenshot 2023-10-25 at 11 35 59

The following screenshot shows the metadata attached when passing the --metadata-enable flag (i.e. metadata collection HAS BEEN opted into)...

Screenshot 2023-10-25 at 13 00 33

NOTE: You'll notice a bunch of secrets have been redacted. We use a combination of a very open-ended regex pattern to err on the side of caution (and this helps catch a large majority of popular formats) + a hardcoded list of env vars that don't fit those formats + any env vars not catered for, the user can add those using --metadata-filter-envvars to ensure they get scrubbed also + we use TruffleHog to identify and redact any secret 'values' it happens to notice.

The following screenshot demonstrates that even if I set --metadata-enable no metadata is collected because I've also set FASTLY_WASM_METADATA_DISABLE=true, so although it's an unlikely situation, we always err on the side of caution and will give precedence to disabling over the flag (typically flags are given highest priority, but I've opted against that here)...

Screenshot 2023-10-25 at 14 24 57

pkg/env/env.go Outdated Show resolved Hide resolved
pkg/commands/compute/build.go Outdated Show resolved Hide resolved
Comment on lines +412 to +435
platform := runtime.GOOS
if platform == "darwin" {
platform = "macos"
}

arch := runtime.GOARCH
if arch == "arm64" {
arch = "aarch64"
}
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Unfortunately this sort of thing isn't really consistent from project to project, so there's a good chance you'll have to make additional special cases in the future for other tools. But since this only applies to wasm-tools for now, it's fine.

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yup, agreed. This was designed to work specifically for wasm-tools and I think somewhere in the code comments I even say something like "once we add more tools this pattern has to be abstracted".

pkg/commands/compute/language_go.go Outdated Show resolved Hide resolved
pkg/commands/compute/build.go Outdated Show resolved Hide resolved
pkg/commands/compute/build.go Outdated Show resolved Hide resolved
pkg/commands/compute/language_go.go Outdated Show resolved Hide resolved
@Integralist Integralist marked this pull request as ready for review September 26, 2023 14:00
@Integralist
Copy link
Collaborator Author

Integralist commented Sep 26, 2023

@joeshaw made changes, please take another look once you get a chance (also if you could review #1013) as once both these PRs are approved/merged I can then open a 3rd PR to tie them together.

@Integralist Integralist force-pushed the integralist/wasm-tools branch 21 times, most recently from 00d2b45 to 33f6947 Compare September 27, 2023 19:36
This is because we now always annotate the Wasm binary. If the user
enables metadata then we annotate lots of data, otherwise we'll default
to annotating the binary with the CLI version and the project language.
@Integralist Integralist force-pushed the integralist/wasm-tools branch from 5d81128 to 1099ab1 Compare October 31, 2023 16:11
@Integralist Integralist merged commit ad0b968 into main Oct 31, 2023
6 checks passed
@Integralist Integralist deleted the integralist/wasm-tools branch October 31, 2023 17:12
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement New feature or request
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants