Ah, the version can actually be overriden by the caller:

class EC2Connection(AWSQueryConnection):
    def __init__( ... api_version=None ...)

https://github.com/boto/boto/blob/8fac1878734c5ac085b781f619c70ea4b6e913c3/boto/ec2/connection.py#L86

So nixops can easily use it without having to modify boto.

It calls boto.ec2.connect_to_region() with just passes on all kwargs to the EC2Connection constructor.

Looking for boto.config.get in turn suggests that we may not need to change any code at all, as these versions can be controlled from the outside with a config file:
http://boto.cloudhackers.com/en/latest/boto_config_tut.html#details

Indeed this has the desired effect on that function:

BOTO_CONFIG=<(echo '[Boto]\nec2_version = 2016-11-15')

Looking for boto.config.get in turn suggests that we may not need to change any code at all, as these versions can be controlled from the outside with a config file:
http://boto.cloudhackers.com/en/latest/boto_config_tut.html#details

Indeed setting this environment variable this has the desired effect on that function:

BOTO_CONFIG=<(echo '[Boto]\nec2_version = 2016-11-15')

Arian: It worked, the machine deployed. Thanks a lot for your help!

https://github.com/benaco/nixops/commit/de0b958b37030c4b4b78e3e69908ad0700d6ae57

I answered the StackOverflow.

That openssl dgst line was definitely what I was missing. Each public key block has a bunch of metadata comments (think of this as a header), the public key line, and a base64-encoded SHA-256 + RSA-PSS signature. This signature is for the metadata comments + public key line.

Since that's signed by an EIC signer cert which rolls all the way up to an Amazon CA, it's protected from spoofing.

That openssl dgst line was definitely what I was missing. Each public key block has a bunch of metadata comments (think of this as a header), the public key line, and a base64-encoded SHA-256 + RSA-PSS signature. This signature is for the metadata comments + public key line.

Since that's signed by an EIC signer cert which rolls all the way up to an Amazon root cert, it's protected from spoofing.

In reply to @arianvp:matrix.org
https://arianvp.github.io/nixcon2024/slides/reveal.js-master/

https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-instance-connect-set-up.html

If you launched your instance using a later version of Amazon Linux, macOS Sonoma, macOS Ventura, macOS Monterey, or Ubuntu, it comes pre-installed with EC2 Instance Connect, and therefore you do not need to install it yourself.