Skip to content

Instantly share code, notes, and snippets.

@arianvp
arianvp / README.md
Last active June 4, 2024 01:48
An error occurred (AccessDenied) when calling the StartInstanceRefresh operation: You are not authorized to use launch template:

An error occurred (AccessDenied) when calling the StartInstanceRefresh operation: You are not authorized to use launch template:

You came here because you Googled the above error and got zero hits. You will now get a hit!

Problem

You have an error like:

An error occurred (AccessDenied) when calling the StartInstanceRefresh operation: You are not authorized to use launch template:
@arianvp
arianvp / thesis.nix
Created March 8, 2023 12:24
thesis.nix
{ pkgs ? import <nixpkgs> {} }:
let
fontsConf = pkgs.makeFontsConf {
fontDirectories = [ ./fonts ];
};
texlive = pkgs.texlive.combine {
inherit (pkgs.texlive)
appendix
tikzmark
@arianvp
arianvp / main.go
Created January 26, 2023 10:12
Fulcio watcher
package main
import (
"context"
"fmt"
"log"
"net/http"
"time"
ct "github.com/google/certificate-transparency-go"
@arianvp
arianvp / simplewebauthn.ts
Created January 19, 2023 08:19
Simplified Webauthn
interface SimpleCredential {
id: string;
publicKey: ArrayBuffer;
}
async function create(name: string) : Promise<SimpleCredential> {
// NOTE: We don't care about the challenge because we don't check attestation
const challenge = crypto.getRandomValues(new Uint8Array(16));
let credential = await navigator.credentials.create({
publicKey: {
@arianvp
arianvp / main.go
Last active June 22, 2025 18:04
TPM2 Activation and Attestation flow in Go
package main
import (
"crypto/ecdsa"
"crypto/elliptic"
"crypto/rand"
"crypto/subtle"
"crypto/x509"
"log"
"math/big"
@arianvp
arianvp / webauthn-dpop.md
Created July 4, 2022 10:07
Using webauthn for sender constrained access tokens

Using webauthn for sender constrained access tokens

Nix.dev @zupo

All the commands in the nix.dev documentation are now checked by CI.

The problem is that we have nested shells; which default tooling for this doesn't work. It works on my machine. What left is polishing and adding it to CI

Nix code samples are extracted into a file such that e.g. following nix-build calls can access those files. So that we can check that the default.nix in the document actually works.

@arianvp
arianvp / flake.nix
Created February 22, 2022 19:18
A flake to deploy app to kubernetes
{
description = "A flake that builds a go app and deploys to kubernetes";
inputs = {
utils.url = "github:numtide/flake-utils";
nixpkgs.url = "nixpkgs/nixpkgs-unstable";
};
outputs = { self, nixpkgs, utils }: utils.lib.eachDefaultSystem (system:
let
{
"cniversion":"1.0.0",
"name":"kube",
"plugins": [
{
"type": "ptp",
"ipam": {
"type": "host-local",
"routes": [ { "dst": "::/0" } ],
"ranges": [ { "subnet": "2001:19f0:6c01:1f10::/80" } ]
@arianvp
arianvp / boot.ipxe
Last active August 31, 2021 16:17
ipxe boot config
#!ipxe
set STREAM stable
set VERSION 34.20210725.3.0
set BASEURL https://builds.coreos.fedoraproject.org/prod/streams/${STREAM}/builds/${VERSION}/x86_64
set NETWORK # ip=bond0:dhcp bond=bond0:enp0s20f0,enp0s20f1:mode=balance-tlb,downdelay=200,updelay=200,miimon=100 nameserver=8.8.8.8
kernel ${BASEURL}/fedora-coreos-${VERSION}-live-kernel-x86_64 initrd=main ignition.platform.id=metal coreos.inst.install_dev=/dev/sda coreos.live.rootfs_url=${BASEURL}/fedora-coreos-${VERSION}-live-rootfs.x86_64.img ignition.firstboot coreos.inst.platform_id=packet console=ttyS1,115200n8 ${NETWORK}