In reply to @arianvp:matrix.org
https://github.com/NixOS/amis/blob/main/upload-ami/src/upload_ami/upload_ami.py#L173

The version is defined here:

https://github.com/boto/boto/blob/8fac1878734c5ac085b781f619c70ea4b6e913c3/boto/ec2/connection.py#L75

    APIVersion = boto.config.get('Boto', 'ec2_version', '2014-10-01')

Now we just apply the nixpkgs wisdom

a sed a day makes the failure go away
and should be good lol

Now we just apply the nixpkgs wisdom

a sed a day makes the failure go away

and should be good lol

Ah, the version can actually be overriden by the caller:

class EC2Connection(AWSQueryConnection):
    def __init__( ... api_version=None ...)

https://github.com/boto/boto/blob/8fac1878734c5ac085b781f619c70ea4b6e913c3/boto/ec2/connection.py#L86

So nixops can easily use it without having to modify boto.

Ah, the version can actually be overriden by the caller:

class EC2Connection(AWSQueryConnection):
    def __init__( ... api_version=None ...)

https://github.com/boto/boto/blob/8fac1878734c5ac085b781f619c70ea4b6e913c3/boto/ec2/connection.py#L86

So nixops can easily use it without having to modify boto.

It calls boto.ec2.connect_to_region() with just passes on all kwargs to the EC2Connection constructor.

Looking for boto.config.get in turn suggests that we may not need to change any code at all, as these versions can be controlled from the outside with a config file:
http://boto.cloudhackers.com/en/latest/boto_config_tut.html#details

Indeed this has the desired effect on that function:

BOTO_CONFIG=<(echo '[Boto]\nec2_version = 2016-11-15')

Looking for boto.config.get in turn suggests that we may not need to change any code at all, as these versions can be controlled from the outside with a config file:
http://boto.cloudhackers.com/en/latest/boto_config_tut.html#details

Indeed setting this environment variable this has the desired effect on that function:

BOTO_CONFIG=<(echo '[Boto]\nec2_version = 2016-11-15')

Arian: It worked, the machine deployed. Thanks a lot for your help!

https://github.com/benaco/nixops/commit/de0b958b37030c4b4b78e3e69908ad0700d6ae57

I answered the StackOverflow.

That openssl dgst line was definitely what I was missing. Each public key block has a bunch of metadata comments (think of this as a header), the public key line, and a base64-encoded SHA-256 + RSA-PSS signature. This signature is for the metadata comments + public key line.

Since that's signed by an EIC signer cert which rolls all the way up to an Amazon CA, it's protected from spoofing.

That openssl dgst line was definitely what I was missing. Each public key block has a bunch of metadata comments (think of this as a header), the public key line, and a base64-encoded SHA-256 + RSA-PSS signature. This signature is for the metadata comments + public key line.

Since that's signed by an EIC signer cert which rolls all the way up to an Amazon root cert, it's protected from spoofing.