move gitlab-toolbox from AWS CLI v1 to v2

Pratik Singhrequested to merge
psingh29-toolbox-awscli-v2-2482 into master

What does this MR do?

Moves the gitlab-toolbox image (Debian and UBI) from AWS CLI v1, installed with pip (awscli==1.46.1), to the official AWS CLI v2 bundle, pinned to 2.38.5 with an SHA256 checksum per architecture.

Changes

  • ci_files/variables.yml: AWSCLI_VERSION is now 2.38.5. Adds AWSCLI_CHECKSUM_SHA256_AMD64 and AWSCLI_CHECKSUM_SHA256_ARM64, following the existing *_CHECKSUM_SHA256 pins.
  • .gitlab/ci/common.gitlab-ci.yml: passes AWSCLI_VERSION and both checksums as --build-arg to build_asset_image and build_final_image for .gitlab-toolbox-ee and .gitlab-toolbox-ce, following the CFSSL pattern. Previously AWSCLI_VERSION was never passed in CI, so only the Dockerfile default took effect.
  • gitlab-toolbox/Dockerfile (Debian):
    • Removes awscli from the pip install in the python stage. s3cmd, gsutil, pyOpenSSL, cryptography and crcmod are unchanged.
    • Adds an awscli stage modeled on the azcopy stage. It downloads awscli-exe-linux-<arch>-<version>.zip, verifies it with sha256sum -c, and runs the bundled installer into /usr/local/aws-cli.
    • The final image copies /usr/local/aws-cli and recreates the /usr/local/bin/aws and aws_completer symlinks. A COPY of the symlinks dereferences them into standalone launchers that can't find their install directory.
    • Sets ENV AWS_PAGER="" so no aws command blocks on a pager.
  • gitlab-toolbox/Dockerfile.build.ubi: same pip removal and download, verify and install logic in the build stage. Adds /usr/local/aws-cli to the cp -R --parents assets list; cp -R preserves the symlinks.
  • gitlab-toolbox/Dockerfile.ubi.erb: sets ENV AWS_PAGER="" in the UBI final image.
  • scripts/renovate/update-awscli-checksum.sh (new): Renovate post-upgrade script, mirroring update-gomplate-checksum.sh. It recomputes both architecture checksums in all three pin locations.

The consumers (backup-utility and object_storage_backup.rb) are unchanged. They only use s3 cp/ls/rm/sync and s3api head-bucket, with flags v2 supports (--endpoint-url, --region, --sse aws:kms, --sse-kms-key-id, --storage-class). The aws s3 ls column layout is the same in v2.

Version and checksums

AWS publishes GPG .sig files rather than SHA256 files, so the checksums were computed from the downloaded bundles. Both bundles were also verified against the AWS CLI Team signing key (FB5D B77F D5C1 18B8 0511 ADA8 A631 0ACC 4672 475C).

Arch Bundle SHA256
amd64 awscli-exe-linux-x86_64-2.38.5.zip 5def7d1b7e55d892f9a381bb2cb2081a685712464be0d36d5d706af0ac48d0d3
arm64 awscli-exe-linux-aarch64-2.38.5.zip 07711a936e9d271045ab937d2c2c5390c25f419e4ba9e25adb9e996031e3f6be

Test plan

Local builds, before the MR pipeline:

Check Debian amd64 Debian arm64 UBI arm64
aws --version reports aws-cli/2.38.5 ✅ ✅ ✅
pip3 show awscli reports not found (v1 removed) ✅ ✅ ✅
AWS_PAGER is set and empty ✅ ✅ ✅
aws s3 ls runs (fails only on missing credentials) ✅ ✅ ✅
s3cmd --version, gsutil version, azcopy --version still work ✅ ✅ ✅
MinIO: head-bucket, cp (40 MB multipart, --storage-class), ls parsing, sync (up, down, bucket-to-bucket, --delete --exclude), rm --recursive — ✅ ✅
  • The UBI asset (Dockerfile.build.ubi) build also passed for amd64, with the checksum verified.
  • MinIO RELEASE.2025-07-23 accepted v2's default checksum headers, so AWS_REQUEST_CHECKSUM_CALCULATION=when_required was not needed.
  • aws <cmd> help fails with "Could not find executable named groff or mandoc". This is not a regression; the current v1 image fails the same way.
  • To do: FIPS and UBI validation through the fips_pipeline bridge job on this MR, and development/tests/awscli/test.sh against real S3.

Notes for reviewers

  • FIPS: AWS CLI v2 bundles its own Python (3.14.8) and OpenSSL (3.5.9) and does not include a FIPS provider. It therefore does not use the system FIPS-validated crypto module in FIPS images, and this needs documenting. AWS_USE_FIPS_ENDPOINT only selects FIPS endpoints; it does not change the crypto module.
  • Renovate: a follow-up MR is needed in renovate-gitlab-bot (renovate/distribution/cng.config.js):
    • Relax allowedVersions: "<2.0.0" for aws/aws-cli to "<3.0.0". Without this, Renovate won't propose v2 updates.
    • Add a postUpgradeTasks rule running ./scripts/renovate/update-awscli-checksum.sh, modeled on the gomplate rule.
    • The existing version patterns already match all three pin locations.
  • S3-compatible endpoints: older MinIO, Ceph or appliance endpoints may reject v2's default checksum headers. Users can opt out with AWS_REQUEST_CHECKSUM_CALCULATION=when_required and AWS_RESPONSE_CHECKSUM_VALIDATION=when_required.
  • Image size: about +120 MB uncompressed. The v2 bundle is about 269 MB and replaces about 154 MB of v1 Python packages.
  • Docs follow-up: docs/development/test-plans/upgrade-awscli-test-plan.md still references the v1 Renovate branch and v1 output.

Signed-off-by: psingh29 psingh@gitlab.com

Related issues

Closes #2482

Checklist

See Definition of done.

For anything in this list which will not be completed, please provide a reason in the MR discussion

Required

  • Merge Request Title, and Description are up to date, accurate, and descriptive
  • MR targeting the appropriate branch
  • MR has a green pipeline on GitLab.com
  • When ready for review, MR is labeled "~workflow::ready for review" per the Distribution MR workflow

Expected (please provide an explanation if not completing)

  • Test plan indicating conditions for success has been posted and passes
  • Documentation created/updated
  • Integration tests added to GitLab QA
  • The impact any change in container size has should be evaluated
  • New dependencies are managed with GitLab forked renovatebot

🤖 Generated with Claude Code

Edited by Pratik Singh

Merge request reports