
Security News
Risky Biz Podcast: Making Reachability Analysis Work in Real-World Codebases
This episode explores the hard problem of reachability analysis, from static analysis limits to handling dynamic languages and massive dependency trees.
This gem provides a framework for automatically creating and publish an AWS Lambda Layer from project gems and their linked libraries for use with Ruby on Jets.
This gem creates a Lambda Layer based on your Jets project namespace and ruby version. I.e. for the app demo
in production
environment,
the Lambda Layer demo-prod-ruby-3_2_2-gem_layer
will be created or its version incremented as needed. A new version is published whenever your
Gemfile.lock and/or Gemfile is changed (this is tracked based on a hash value stored in the Lambda Layer version description).
public.ecr.aws/sam/build-ruby:3.2
. The container version
is based on the current minor ruby version (i.e. 3.2 for ruby 3.2.2, so ensure your build environment's ruby version
is correctly set for your project.# config/application.rb
config.pro.disable = true
# config/application.rb
require 'jets_gem_layer'
module CrmBroker
class Application < Jets::Application
# JetsGemLayer.arn will resolve to the latest version of the published Layer, also looking for a correct hash in the
# layer description indicating the current Gemfile.lock and Gemfile are supported.
# If a suitable layer is not found, the gem will log an error and resolve to 'error-fetching-gem-layer-arn' which will allow your
# application to run locally but hopefully prevent an invalid deployment
config.lambda.layers = [JetsGemLayer.arn]
# ...
end
end
# Gemfile
gem 'jets_gem_layer'
# Rakefile
require 'jets'
require_relative 'config/application'
Jets.application.load_tasks
JetsGemLayer.load_tasks
bundle install
, run rake -T
and you should see this Gem's tasks available for use.➜ rake -T
rake gem_layer:build_and_publish # Build and publish a gem layer version, if necessary
rake gem_layer:build # Build a gem layer zip file
rake gem_layer:publish # Publish the already built layer zip file
rake gem_layer:clean # Clean jets_gem_layer tmp files
rake gem_layer:cleanup_published # Delete old layer versions from AWS (for use after deployment)
rake gem_layer:delete_all_published # Delete all published versions of the gem layer from AWS
The following environmental variables may be used:
GEM_LAYER_ENV
: Comma-separated key=value
pairs which will be added to the docker build environment.
For example, to pass a Gemfury token for Bundler, you could use GEM_LAYER_ENV="BUNDLE_GEM__FURY__IO=xxyyzz"
and BUNDLE_GEM__FURY__IO
will be set correctly within the build container.GEM_LAYER_PACKAGE_DEPENDENCIES
: use this to identify comma separated dependencies required for bundle install
specific to your Gemfile. For example, to build the mysql2
gem you will need to set GEM_LAYER_PACKAGE_DEPENDENCIES=mysql-devel
.
Dependencies will be installed within the build container and copied into the published Lambda Layer.Within your project directory (example for development environment) or through your CI/CD platform:
JETS_ENV=development rake gem_layer:build_and_publish
JETS_ENV=development JETS_AGREE=no jets deploy
JETS_ENV=development rake gem_layer:cleanup_published
Important: The zip command must be installed in your environment or the layer will fail to zip and upload. Perhaps we will switch to rubyzip in the future.
A big thank you to the authors of Lambda Layer Cake, which served as a reference.
FAQs
Unknown package
We found that jets_gem_layer demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
This episode explores the hard problem of reachability analysis, from static analysis limits to handling dynamic languages and massive dependency trees.
Security News
/Research
Malicious Nx npm versions stole secrets and wallet info using AI CLI tools; Socket’s AI scanner detected the supply chain attack and flagged the malware.
Security News
CISA’s 2025 draft SBOM guidance adds new fields like hashes, licenses, and tool metadata to make software inventories more actionable.