Fix: awscli forces upper bound on rsa version (#6774, #7919) by achave11-ucsc · Pull Request #7884 · DataBiosphere/azul

achave11-ucsc · 2026-03-18T21:41:55Z

Linked issues: #6774, #7919

Checklist

Author

¹ when the issue title describes a problem, the corresponding PR
title is Fix: followed by the issue title

Author (partiality)

Added p tag to titles of partial commits
This PR is labeled partial _{or completely resolves all linked issues}
This PR partially resolves each of the linked issues _{or does not have the partial label}

Author (reindex)

Added r tag to commit title _{or the changes introduced by this PR will not require reindexing of any deployment}
This PR is labeled reindex:dev _{or the changes introduced by it will not require reindexing of dev}
This PR is labeled reindex:anvildev _{or the changes introduced by it will not require reindexing of anvildev}
This PR is labeled reindex:anvilprod _{or the changes introduced by it will not require reindexing of anvilprod}
This PR is labeled reindex:prod _{or the changes introduced by it will not require reindexing of prod}
This PR is labeled reindex:partial and its description documents the specific reindexing procedure for dev, anvildev, anvilprod and prod _{or requires a full reindex or carries none of the labels reindex:dev, reindex:anvildev, reindex:anvilprod and reindex:prod}

Author (mirror)

This PR is labeled mirror:dev _{or the changes introduced by it will not require mirroring of dev}
This PR is labeled mirror:anvildev _{or the changes introduced by it will not require mirroring of anvildev}
This PR is labeled mirror:anvilprod _{or the changes introduced by it will not require mirroring of anvilprod}
This PR is labeled mirror:prod _{or the changes introduced by it will not require mirroring of prod}
This PR is labeled mirror:partial and its description documents the specific mirroring procedure for dev, anvildev, anvilprod and prod _{or requires a full mirroring or carries none of the labels mirror:dev, mirror:anvildev, mirror:anvilprod and mirror:prod}

Author (API changes)

This PR and its linked issues are labeled API _{or this PR does not modify a REST API}
Added a (A) tag to commit title for backwards (in)compatible changes _{or this PR does not modify a REST API}
Updated REST API version number in app.py _{or this PR does not modify a REST API}

Author (upgrading deployments)

Ran make docker_images.json and committed the resulting changes _{or this PR does not modify azul_docker_images, or any other variables referenced in the definition of that variable}
Documented upgrading of deployments in UPGRADING.rst _{or this PR does not require upgrading deployments}
Added u tag to commit title _{or this PR does not require upgrading deployments}
This PR is labeled upgrade _{or does not require upgrading deployments}
This PR is labeled deploy:shared _{or does not modify docker_images.json, and does not require deploying the shared component for any other reason}
This PR is labeled deploy:gitlab _{or does not require deploying the gitlab component}
This PR is labeled deploy:runner _{or does not require deploying the runner image}

Author (hotfixes)

Added F tag to main commit title _{or this PR does not include permanent fix for a temporary hotfix}
Reverted the temporary hotfixes for any linked issues _{or the none of the stable branches (anvilprod and prod) have temporary hotfixes for any of the issues linked to this PR}

Author (before every review)

Rebased PR branch on develop, squashed fixups from prior reviews
Ran make requirements_update _{or this PR does not modify Dockerfile, environment, requirements*.txt, common.mk, Makefile or environment.boot}
Added R tag to commit title _{or this PR does not modify requirements*.txt}
This PR is labeled reqs _{or does not modify requirements*.txt}
make integration_test passes in personal deployment _{or this PR does not modify functionality that could affect the IT outcome}
PR is awaiting requested review from a peer
Status of PR is Review requested
PR is assigned to only the peer and the author

Peer reviewer (after approval)

Note that after requesting changes, the PR must be assigned to only the author.

Actually approved the PR
PR is not a draft
PR is awaiting requested review from system administrator
Status of PR is Review requested
PR is assigned to only the system administrator and the author

System administrator (after approval)

Actually approved the PR
Labeled linked issues as demo or no demo
Commented on linked issues about demo expectations _{or all linked issues are labeled no demo}
Decided if PR can be labeled no sandbox
A comment to this PR details the completed security design review
PR title is appropriate as title of merge commit
N reviews label is accurate
Status of PR is Approved
PR is assigned to only the operator and the author

Operator

Checked reindex:… labels and r commit title tag
Checked mirror:… labels
Checked that demo expectations are clear _{or all linked issues are labeled no demo}
Squashed PR branch and rebased onto develop
Sanity-checked history
Pushed PR branch to GitHub

Operator (deploy `.shared` and `.gitlab` components)

Ran _select dev.shared && CI_COMMIT_REF_NAME=develop make -C terraform/shared apply_keep_unused _{or this PR is not labeled deploy:shared}
Ran _select dev.gitlab && CI_COMMIT_REF_NAME=develop make -C terraform/gitlab apply _{or this PR is not labeled deploy:gitlab}
Ran _select anvildev.shared && CI_COMMIT_REF_NAME=develop make -C terraform/shared apply_keep_unused _{or this PR is not labeled deploy:shared}
Ran _select anvildev.gitlab && CI_COMMIT_REF_NAME=develop make -C terraform/gitlab apply _{or this PR is not labeled deploy:gitlab}
Checked the items in the next section _{or this PR is labeled deploy:gitlab}
PR is assigned to only the system administrator and the author _{or this PR is not labeled deploy:gitlab}

System administrator (post-deploy of `.gitlab` component)

Background migrations for dev.gitlab are complete _{or this PR is not labeled deploy:gitlab}
Background migrations for anvildev.gitlab are complete _{or this PR is not labeled deploy:gitlab}
PR is assigned to only the operator and the author

Operator (deploy runner image)

Ran _select dev.gitlab && make -C terraform/gitlab/runner _{or this PR is not labeled deploy:runner}
Ran _select anvildev.gitlab && make -C terraform/gitlab/runner _{or this PR is not labeled deploy:runner}

Operator (sandbox build)

Operator (merge the branch)

All status checks passed and the PR is mergeable
The title of the merge commit starts with the title of this PR
Added PR # reference to merge commit title
Collected commit title tags in merge commit title _{but only included p if the PR is also labeled partial}
Pushed merge commit to GitHub
Status of PR is Merged lower
Status of blocked issues is Triage _{or no issues are blocked on the linked issues}

Operator (main build)

Operator (reindex)

Operator (mirroring)

Started mirroring in dev _{or this PR is not labelled mirror:dev}
Started mirroring in anvildev _{or this PR is not labelled mirror:anvildev}
Checked for, triaged and possibly requeued messages in mirror fail queue in dev _{or this PR is not labelled mirror:dev}
Checked for, triaged and possibly requeued messages in mirror fail queue in anvildev _{or this PR is not labelled mirror:anvildev}
Emptied mirror fail queue in dev _{or this PR is not labelled mirror:dev}
Emptied mirror fail queue in anvildev _{or this PR is not labelled mirror:anvildev}

Operator

Propagated the deploy:shared, deploy:gitlab, deploy:runner, API, reindex:partial, reindex:anvilprod, reindex:prod, mirror:partial, mirror:anvilprod and mirror:prod labels to the next promotion PRs _{or this PR carries none of these labels}
Propagated any specific instructions related to the deploy:shared, deploy:gitlab, deploy:runner, API, reindex:partial, reindex:anvilprod, reindex:prod, mirror:partial, mirror:anvilprod and mirror:prod labels, from the description of this PR to that of the next promotion PRs _{or this PR carries none of these labels}
PR is assigned to no one

Shorthand for review comments

L line is too long
W line wrapping is wrong
Q bad quotes
F other formatting problem

coveralls · 2026-03-18T21:54:00Z

coverage: 85.119%. remained the same — issues/achave11-ucsc/6774-update-awscli into develop

codecov · 2026-03-18T22:04:55Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 85.03%. Comparing base (bb84990) to head (e1cd939).
⚠️ Report is 5 commits behind head on develop.

Additional details and impacted files

@@           Coverage Diff            @@
##           develop    #7884   +/-   ##
========================================
  Coverage    85.03%   85.03%           
========================================
  Files          162      162           
  Lines        23306    23306           
========================================
  Hits         19819    19819           
  Misses        3487     3487

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

nadove-ucsc

Changes look good. please post evidence showing that all programmatic invocations of the AWS CLI have been tested, as instructed.

achave11-ucsc · 2026-03-31T18:29:48Z

please post evidence showing that all programmatic invocations of the AWS CLI have been tested, as instructed.

Consider it done, but please note that posting evidence wasn't a directive to resolving this issue. Additionally, in a PL with @hannes-ucsc, it was agreed to skip testing on the invocations related to the vpn section.

For evidence, see the GitLab dev pipeline https://gitlab.dev.singlecell.gi.ucsc.edu/ucsc/azul/-/pipelines/51575 and the script output excerpt below:

❯ python scripts/create_gitlab_snapshot.py
2026-03-31 08:33:32,267    INFO MainThread botocore.credentials: Found credentials in shared credentials file: ~/.aws/credentials
2026-03-31 08:33:32,339    INFO MainThread azul.deployment: Allocated new Boto3 client for 'ec2' with ID 4441156176
2026-03-31 08:33:32,936    INFO MainThread __main__: Preparing to stop GitLab instance in 'dev'. Waiting 10 seconds before proceeding. Hit Ctrl-C to abort …
2026-03-31 08:33:42,941    INFO MainThread __main__: Stopping instance 'i-008b34476cc809777' …
2026-03-31 08:34:44,705    INFO MainThread __main__: Instance 'i-008b34476cc809777' has stopped
2026-03-31 08:34:44,721    INFO MainThread azul.deployment: Allocated new Boto3 client for 'sts' with ID 4443955824
2026-03-31 08:34:45,689    INFO MainThread __main__: Snapshot 'snap-0ce11a061ae3b8c1c' of volume 'vol-03b3eb0967f44064f' is being created …
2026-03-31 08:57:31,341    INFO MainThread __main__: Snapshot 'snap-0ce11a061ae3b8c1c' of volume 'vol-03b3eb0967f44064f' is complete
2026-03-31 08:57:31,341    INFO MainThread __main__: Starting instance 'i-008b34476cc809777' …
2026-03-31 09:00:50,007    INFO MainThread __main__: Instance 'i-008b34476cc809777' is running

achave11-ucsc · 2026-04-15T22:15:57Z

+		echo -e "\nLooks like the AWS CLI is not installed.\n"; \
+		false; \
+	fi
+	@if ! aws --version 2>&1 | grep -qF "aws-cli/$$azul_awscli_version "; then \


The trailing space prevents prefix matching.

❯ docker run -it docker.gitlab.dev.singlecell.gi.ucsc.edu/ucsc/azul/dev:latest aws --version aws-cli/2.34.30 Python/3.14.4 Linux/6.12.76-linuxkit exe/aarch64.debian.13

hannes-ucsc · 2026-04-16T20:41:26Z

achave11-ucsc changed the title ~~Fix: awscli forces upper bound on rsa version #6774~~ Fix: awscli forces upper bound on rsa version (#6774) Mar 18, 2026

achave11-ucsc self-assigned this Mar 18, 2026

achave11-ucsc added reqs [process] PR includes commit requiring ``make requirements`` upgrade [process] PR includes commit requiring manual upgrade labels Mar 18, 2026

achave11-ucsc force-pushed the issues/achave11-ucsc/6774-update-awscli branch from 3d5daae to 167584a Compare March 18, 2026 21:53

achave11-ucsc force-pushed the issues/achave11-ucsc/6774-update-awscli branch 4 times, most recently from a73f71f to 836c0dc Compare March 26, 2026 18:22

achave11-ucsc requested a review from nadove-ucsc March 26, 2026 20:02

achave11-ucsc assigned nadove-ucsc Mar 26, 2026

nadove-ucsc reviewed Mar 26, 2026

View reviewed changes

nadove-ucsc removed their assignment Mar 27, 2026

achave11-ucsc linked an issue Mar 30, 2026 that may be closed by this pull request

awscli forces upper bound on rsa version #6774

Open

achave11-ucsc force-pushed the issues/achave11-ucsc/6774-update-awscli branch from 836c0dc to 2b83923 Compare March 30, 2026 18:14

achave11-ucsc added the deploy:runner [process] PR requires deploying `runner` component label Mar 30, 2026

achave11-ucsc force-pushed the issues/achave11-ucsc/6774-update-awscli branch 7 times, most recently from b9fe523 to bdffab6 Compare March 31, 2026 04:04

achave11-ucsc requested a review from nadove-ucsc March 31, 2026 18:29

achave11-ucsc assigned nadove-ucsc and unassigned nadove-ucsc Mar 31, 2026

achave11-ucsc removed the request for review from nadove-ucsc March 31, 2026 21:38

hannes-ucsc added the 1 review [process] Lead requested changes once label Apr 7, 2026

hannes-ucsc removed their assignment Apr 7, 2026

achave11-ucsc dismissed nadove-ucsc’s stale review via 2983287 April 15, 2026 18:17

achave11-ucsc force-pushed the issues/achave11-ucsc/6774-update-awscli branch 4 times, most recently from b80313d to 0badc93 Compare April 15, 2026 22:12

achave11-ucsc commented Apr 15, 2026

View reviewed changes

achave11-ucsc linked an issue Apr 15, 2026 that may be closed by this pull request

Cannot build Azul image on Apple Silicon #7919

Open

achave11-ucsc changed the title ~~Fix: awscli forces upper bound on rsa version (#6774)~~ Fix: awscli forces upper bound on rsa version (#6774, #7919) Apr 15, 2026

achave11-ucsc requested a review from hannes-ucsc April 15, 2026 22:24

achave11-ucsc assigned hannes-ucsc Apr 15, 2026

achave11-ucsc removed the deploy:runner [process] PR requires deploying `runner` component label Apr 15, 2026

hannes-ucsc previously approved these changes Apr 16, 2026

View reviewed changes

hannes-ucsc assigned dsotirho-ucsc and unassigned hannes-ucsc Apr 16, 2026

achave11-ucsc added 3 commits April 16, 2026 22:35

[R] Fix: Cannot build Azul image on Apple Silicon (#7919)

981beaf

[u] Add awscli v2 (#6774)

b1e886b

[R] Remove awscli and rsa from requirements (#6774)

bae04a9

dsotirho-ucsc force-pushed the issues/achave11-ucsc/6774-update-awscli branch from 686b75a to bae04a9 Compare April 17, 2026 05:35

dsotirho-ucsc added the sandbox [process] Resolution is being verified in sandbox deployment label Apr 17, 2026

dsotirho-ucsc removed their request for review April 17, 2026 05:46

[R] Ran make requirements_update

e1cd939

dsotirho-ucsc dismissed hannes-ucsc’s stale review via e1cd939 April 17, 2026 05:50

hannes-ucsc approved these changes Apr 17, 2026

View reviewed changes

dsotirho-ucsc merged commit 99cba4d into develop Apr 17, 2026
10 checks passed

dsotirho-ucsc unassigned achave11-ucsc Apr 17, 2026

dsotirho-ucsc deleted the issues/achave11-ucsc/6774-update-awscli branch April 17, 2026 16:55

dsotirho-ucsc removed their assignment Apr 17, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Fix: awscli forces upper bound on rsa version (#6774, #7919)#7884

Fix: awscli forces upper bound on rsa version (#6774, #7919)#7884
dsotirho-ucsc merged 4 commits intodevelopfrom
issues/achave11-ucsc/6774-update-awscli

achave11-ucsc commented Mar 18, 2026 •

edited by dsotirho-ucsc

Loading

Uh oh!

coveralls commented Mar 18, 2026 •

edited

Loading

Uh oh!

codecov bot commented Mar 18, 2026 •

edited

Loading

Uh oh!

nadove-ucsc left a comment

Uh oh!

achave11-ucsc commented Mar 31, 2026 •

edited

Loading

Uh oh!

achave11-ucsc Apr 15, 2026 •

edited

Loading

Uh oh!

hannes-ucsc commented Apr 16, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

Conversation

achave11-ucsc commented Mar 18, 2026 • edited by dsotirho-ucsc Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Checklist

Author

Author (partiality)

Author (reindex)

Author (mirror)

Author (API changes)

Author (upgrading deployments)

Author (hotfixes)

Author (before every review)

Peer reviewer (after approval)

System administrator (after approval)

Operator

Operator (deploy .shared and .gitlab components)

System administrator (post-deploy of .gitlab component)

Operator (deploy runner image)

Operator (sandbox build)

Operator (merge the branch)

Operator (main build)

Operator (reindex)

Operator (mirroring)

Operator

Shorthand for review comments

Uh oh!

coveralls commented Mar 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

codecov bot commented Mar 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

nadove-ucsc left a comment

Choose a reason for hiding this comment

Uh oh!

achave11-ucsc commented Mar 31, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

achave11-ucsc Apr 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

hannes-ucsc commented Apr 16, 2026

Security design review

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

achave11-ucsc commented Mar 18, 2026 •

edited by dsotirho-ucsc

Loading

Operator (deploy `.shared` and `.gitlab` components)

System administrator (post-deploy of `.gitlab` component)

coveralls commented Mar 18, 2026 •

edited

Loading

codecov bot commented Mar 18, 2026 •

edited

Loading

achave11-ucsc commented Mar 31, 2026 •

edited

Loading

achave11-ucsc Apr 15, 2026 •

edited

Loading