From 7420e336b2d9f29e41e31a52a7c174496bdcd5d8 Mon Sep 17 00:00:00 2001
From: Elad Ben-Israel <benisrae@amazon.com>
Date: Wed, 1 Sep 2021 00:36:00 +0300
Subject: [PATCH] fix(core): inconsistent analytics string across operating
 systems (#16300)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The gzip header includes an “OS” byte that indicates which operating system was used to perform the operation. This means that the CDK Metadata analytics string would be different for the same CDK app in two different operating systems.

To address this, we explicitly set the [gzip OS flag] to 255 (unknown).

Fixes #15322

[gzip OS flag]: https://datatracker.ietf.org/doc/html/rfc1952


----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
---
 .../core/lib/private/metadata-resource.ts     | 51 ++++++++++++++++++-
 .../core/test/metadata-resource.test.ts       |  7 +++
 2 files changed, 57 insertions(+), 1 deletion(-)

diff --git a/packages/@aws-cdk/core/lib/private/metadata-resource.ts b/packages/@aws-cdk/core/lib/private/metadata-resource.ts
index 1cccc4f24ff3d..b74fe41e17a2e 100644
--- a/packages/@aws-cdk/core/lib/private/metadata-resource.ts
+++ b/packages/@aws-cdk/core/lib/private/metadata-resource.ts
@@ -74,8 +74,13 @@ export function formatAnalytics(infos: ConstructInfo[]) {
   infos.forEach(info => insertFqnInTrie(`${info.version}!${info.fqn}`, trie));
 
   const plaintextEncodedConstructs = prefixEncodeTrie(trie);
-  const compressedConstructs = zlib.gzipSync(Buffer.from(plaintextEncodedConstructs)).toString('base64');
+  const compressedConstructsBuffer = zlib.gzipSync(Buffer.from(plaintextEncodedConstructs));
 
+  // set OS flag to "unknown" in order to ensure we get consistent results across operating systems
+  // see https://github.com/aws/aws-cdk/issues/15322
+  setGzipOperatingSystemToUnknown(compressedConstructsBuffer);
+
+  const compressedConstructs = compressedConstructsBuffer.toString('base64');
   return `v2:deflate64:${compressedConstructs}`;
 }
 
@@ -125,3 +130,47 @@ function prefixEncodeTrie(trie: Trie) {
   });
   return prefixEncoded;
 }
+
+/**
+ * Sets the OS flag to "unknown" in order to ensure we get consistent results across operating systems.
+ *
+ * @see https://datatracker.ietf.org/doc/html/rfc1952#page-5
+ *
+ *   +---+---+---+---+---+---+---+---+---+---+
+ *   |ID1|ID2|CM |FLG|     MTIME     |XFL|OS |
+ *   +---+---+---+---+---+---+---+---+---+---+
+ *   | 0 | 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 |
+ *   +---+---+---+---+---+---+---+---+---+---+
+ *
+ * OS (Operating System)
+ * =====================
+ * This identifies the type of file system on which compression
+ * took place.  This may be useful in determining end-of-line
+ * convention for text files.  The currently defined values are
+ * as follows:
+ *      0 - FAT filesystem (MS-DOS, OS/2, NT/Win32)
+ *      1 - Amiga
+ *      2 - VMS (or OpenVMS)
+ *      3 - Unix
+ *      4 - VM/CMS
+ *      5 - Atari TOS
+ *      6 - HPFS filesystem (OS/2, NT)
+ *      7 - Macintosh
+ *      8 - Z-System
+ *      9 - CP/M
+ *     10 - TOPS-20
+ *     11 - NTFS filesystem (NT)
+ *     12 - QDOS
+ *     13 - Acorn RISCOS
+ *    255 - unknown
+ *
+ * @param gzipBuffer A gzip buffer
+ */
+function setGzipOperatingSystemToUnknown(gzipBuffer: Buffer) {
+  // check that this is indeed a gzip buffer (https://datatracker.ietf.org/doc/html/rfc1952#page-6)
+  if (gzipBuffer[0] !== 0x1f || gzipBuffer[1] !== 0x8b) {
+    throw new Error('Expecting a gzip buffer (must start with 0x1f8b)');
+  }
+
+  gzipBuffer[9] = 255;
+}
\ No newline at end of file
diff --git a/packages/@aws-cdk/core/test/metadata-resource.test.ts b/packages/@aws-cdk/core/test/metadata-resource.test.ts
index ca87ae9d252f6..a1fed889d9894 100644
--- a/packages/@aws-cdk/core/test/metadata-resource.test.ts
+++ b/packages/@aws-cdk/core/test/metadata-resource.test.ts
@@ -125,6 +125,13 @@ describe('formatAnalytics', () => {
     expectAnalytics(constructInfo, '1.2.3!aws-cdk-lib.{Construct,CfnResource,Stack},0.1.2!aws-cdk-lib.{CoolResource,OtherResource}');
   });
 
+  test('ensure gzip is encoded with "unknown" operating system to maintain consistent output across systems', () => {
+    const constructInfo = [{ fqn: 'aws-cdk-lib.Construct', version: '1.2.3' }];
+    const analytics = formatAnalytics(constructInfo);
+    const gzip = Buffer.from(analytics.split(':')[2], 'base64');
+    expect(gzip[9]).toBe(255);
+  });
+
   // Compares the output of formatAnalytics with an expected (plaintext) output.
   // For ease of testing, the plaintext versions are compared rather than the encoded versions.
   function expectAnalytics(constructs: ConstructInfo[], expectedPlaintext: string) {