View a markdown version of this page

Download and verify the runtime binaries - Amazon EKS
What a release containsDownload a releaseVerify a release
Services or capabilities described in Amazon Web Services documentation might vary by Region. To see the differences applicable to the China Regions, see Getting Started with Amazon Web Services in China (PDF).

Help improve this page

To contribute to this user guide, choose the Edit this page on GitHub link that is located in the right pane of every page.

Download and verify the runtime binaries

If you build your own node images instead of using the AMIs that Amazon manages, you install the Nitro Sandbox runtime binaries yourself. Amazon publishes them as a signed release for each supported architecture (x86_64 and aarch64), under the Amazon Intellectual Property License. The binaries require glibc 2.34 or later. You do not need an Amazon account to download or verify a release.

This topic covers the runtime binaries release. The host-kernel patch series and the guest image that you also need to build an AMI are published separately. For the full build procedure, see Create and update a Nitro Sandbox AMI.

What a release contains

For each architecture, Amazon publishes the following files:

File Contents

nitro-sandboxes-runtime.tar.gz

The runtime binaries — the shim (containerd-shim-nitro-sandbox-v2), eks-nitro-sandbox-genpolicy, and nitro-sandbox-keyprovider — plus LICENSE and ATTRIBUTION. The archive extracts flat, with no directories.

SHA256SUM

SHA-256 hashes of the archive and of each binary. This is the file that Amazon signs.

SHA256SUM.sig

The detached signature over SHA256SUM.

The download links resolve to the latest release, so you do not need to track version numbers. To pin a specific release instead, replace latest in the download and verification URLs with the release version (for example, 0.1.4274.0).

Note

Verify the release with the SHA256SUM file you download separately (alongside the archive), not the SHA256SUM file found inside the extracted archive. The two have the same name but different contents: the downloaded manifest is the one Amazon signs and covers the archive and each binary, while the copy inside the archive covers a different set of files. The signature verification in the next section succeeds only against the downloaded manifest.

Download a release

Download the archive for your node architecture:

Extract the archive:

tar -xzf nitro-sandboxes-runtime.tar.gz
Note

Depending on your version of tar, extraction might print implausibly old time stamp warnings for the archive members. This is expected and does not indicate a problem: the archive uses fixed timestamps for reproducible builds, and tar still exits successfully.

To confirm that what you downloaded is what Amazon published, verify the download before you use the binaries, as described in the next section.

Verify a release

Amazon signs each release so that you can confirm it is intact and came from Amazon. This step is optional but recommended. Alongside each archive, Amazon publishes a checksum manifest (SHA256SUM) and a detached signature over that manifest (SHA256SUM.sig). The signature is produced with an asymmetric Amazon KMS key (ECDSA on the NIST P-384 curve). You verify the signature with the public key.

  1. Create the public key file. Copy the following into a text file named nitro-sandboxes-runtime-v1.pub:

    -----BEGIN PUBLIC KEY-----
MHYwEAYHKoZIzj0CAQYFK4EEACIDYgAESqdVXO82n+Zh5+IFLh1xjmxZLkjjZWvf
DCS927SdVYjP0AZ92XCxS+ucrs9cjuNlTaDARTHov2XVfMVgau8TEPFKGDRmVZXJ
c25CVihKHLFK8T8hNMIL+fbGcvE2fwIO
-----END PUBLIC KEY-----

  2. Download the checksum manifest and its signature for your architecture into the same directory as the archive. For x86_64, download SHA256SUM and SHA256SUM.sig. For aarch64, download SHA256SUM and SHA256SUM.sig.

  3. Verify the signature over the manifest. The digest is SHA-384 (it pairs with the P-384 key), even though the hashes listed inside the manifest are SHA-256:

    openssl dgst -sha384 -verify nitro-sandboxes-runtime-v1.pub \
  -signature SHA256SUM.sig SHA256SUM

    The command prints Verified OK on success. Any other output means the manifest or signature is not what Amazon published; do not use the download.

  4. Verify the downloaded archive and the extracted binaries against the signed manifest:

    sha256sum -c SHA256SUM

    The SHA256SUM manifest covers the archive and each binary in it, so sha256sum prints one OK line per file. Any FAILED line means that file does not match what Amazon published; do not use the download.