From 7882a5e6bb7e06121a4c63327dac5715e5e8e047 Mon Sep 17 00:00:00 2001 From: Tiger Kaovilai Date: Mon, 18 Nov 2024 00:22:55 -0500 Subject: [PATCH] Publish boringcrypto image Signed-off-by: Tiger Kaovilai --- .github/workflows/e2e-test-kind.yaml | 15 +++++++++++++++ .github/workflows/push.yml | 1 + Dockerfile | 21 ++++++++++++++++++++- Makefile | 3 +++ changelogs/unreleased/8412-kaovilai | 1 + hack/build.sh | 10 ++++++++++ hack/docker-push.sh | 5 +++++ 7 files changed, 55 insertions(+), 1 deletion(-) create mode 100644 changelogs/unreleased/8412-kaovilai diff --git a/.github/workflows/e2e-test-kind.yaml b/.github/workflows/e2e-test-kind.yaml index 6df789f8944..5228e2a5f48 100644 --- a/.github/workflows/e2e-test-kind.yaml +++ b/.github/workflows/e2e-test-kind.yaml @@ -44,6 +44,21 @@ jobs: run: | IMAGE=velero VERSION=pr-test make container docker save velero:pr-test -o ./velero.tar + # validate boringcrypto + # make local uses build.sh that verifies boringcrypto + build-boring: + runs-on: ubuntu-latest + steps: + - name: Check out the code + uses: actions/checkout@v4 + - name: Set up Go + uses: actions/setup-go@v5 + with: + go-version-file: 'go.mod' + - name: Build Velero CLI + if: steps.cli-cache.outputs.cache-hit != 'true' + run: | + GOEXPERIMENT=boringcrypto make local # Create json of k8s versions to test # from guide: https://stackoverflow.com/a/65094398/4590470 setup-test-matrix: diff --git a/.github/workflows/push.yml b/.github/workflows/push.yml index a4d2371734b..871e14bc214 100644 --- a/.github/workflows/push.yml +++ b/.github/workflows/push.yml @@ -69,6 +69,7 @@ jobs: # Build and push Velero image to docker registry docker login -u ${{ secrets.DOCKER_USER }} -p ${{ secrets.DOCKER_PASSWORD }} VERSION=$(./hack/docker-push.sh | grep 'VERSION:' | awk -F: '{print $2}' | xargs) + GOEXPERIMENT=boringcrypto SUFFIX=boringcrypto ./hack/docker-push.sh && echo published boringcrypto image # Upload Velero image package to GCS source hack/ci/build_util.sh diff --git a/Dockerfile b/Dockerfile index 25b314a1115..c7d687e0eb8 100644 --- a/Dockerfile +++ b/Dockerfile @@ -25,6 +25,7 @@ ARG GIT_TREE_STATE ARG TARGETOS ARG TARGETARCH ARG TARGETVARIANT +ARG GOEXPERIMENT ENV CGO_ENABLED=0 \ GO111MODULE=on \ @@ -32,6 +33,7 @@ ENV CGO_ENABLED=0 \ GOOS=${TARGETOS} \ GOARCH=${TARGETARCH} \ GOARM=${TARGETVARIANT} \ + GOEXPERIMENT=${GOEXPERIMENT} \ LDFLAGS="-X ${PKG}/pkg/buildinfo.Version=${VERSION} -X ${PKG}/pkg/buildinfo.GitSHA=${GIT_SHA} -X ${PKG}/pkg/buildinfo.GitTreeState=${GIT_TREE_STATE} -X ${PKG}/pkg/buildinfo.ImageRegistry=${REGISTRY}" WORKDIR /go/src/github.com/vmware-tanzu/velero @@ -55,13 +57,15 @@ ARG TARGETOS ARG TARGETARCH ARG TARGETVARIANT ARG RESTIC_VERSION +ARG GOEXPERIMENT ENV CGO_ENABLED=0 \ GO111MODULE=on \ GOPROXY=${GOPROXY} \ GOOS=${TARGETOS} \ GOARCH=${TARGETARCH} \ - GOARM=${TARGETVARIANT} + GOARM=${TARGETVARIANT} \ + GOEXPERIMENT=${GOEXPERIMENT} COPY . /go/src/github.com/vmware-tanzu/velero @@ -70,6 +74,21 @@ RUN mkdir -p /output/usr/bin && \ /go/src/github.com/vmware-tanzu/velero/hack/build-restic.sh && \ go clean -modcache -cache +# validate that FIPS is enabled in the binaries +FROM --platform=$BUILDPLATFORM golang:1.22-bookworm AS fips-validator +ARG GOEXPERIMENT +ARG BIN +COPY --from=velero-builder /output / +COPY --from=restic-builder /output / +RUN if [ "${GOEXPERIMENT}" = "boringcrypto" ]; then \ + go tool nm ${BIN} > ${BIN}nm && \ + go tool nm velero-helper > velero-helpernm && \ + go tool nm restic > resticnm && \ + grep ${BIN}nm -qe crypto/internal/boring/fipstls.required && \ + grep velero-helpernm -qe crypto/internal/boring/fipstls.required && \ + grep resticnm -qe crypto/internal/boring/fipstls.required && \ + fi + # Velero image packing section FROM paketobuildpacks/run-jammy-tiny:latest diff --git a/Makefile b/Makefile index 98fd436eb41..b21f353367a 100644 --- a/Makefile +++ b/Makefile @@ -143,6 +143,7 @@ local: build-dirs GOOS=$(GOOS) \ GOARCH=$(GOARCH) \ GOBIN=$(GOBIN) \ + GOEXPERIMENT=${GOEXPERIMENT} \ VERSION=$(VERSION) \ REGISTRY=$(REGISTRY) \ PKG=$(PKG) \ @@ -159,6 +160,7 @@ _output/bin/$(GOOS)/$(GOARCH)/$(BIN): build-dirs $(MAKE) shell CMD="-c '\ GOOS=$(GOOS) \ GOARCH=$(GOARCH) \ + GOEXPERIMENT=${GOEXPERIMENT} \ GOBIN=$(GOBIN) \ VERSION=$(VERSION) \ REGISTRY=$(REGISTRY) \ @@ -204,6 +206,7 @@ endif $(addprefix -t , $(IMAGE_TAGS)) \ $(addprefix -t , $(GCR_IMAGE_TAGS)) \ --build-arg=GOPROXY=$(GOPROXY) \ + --build-arg=GOEXPERIMENT=$(GOEXPERIMENT) \ --build-arg=PKG=$(PKG) \ --build-arg=BIN=$(BIN) \ --build-arg=VERSION=$(VERSION) \ diff --git a/changelogs/unreleased/8412-kaovilai b/changelogs/unreleased/8412-kaovilai new file mode 100644 index 00000000000..49f98703c84 --- /dev/null +++ b/changelogs/unreleased/8412-kaovilai @@ -0,0 +1 @@ +Make creating boringcrypto image/bin possible diff --git a/hack/build.sh b/hack/build.sh index 064b583ef4d..7c239f2123b 100755 --- a/hack/build.sh +++ b/hack/build.sh @@ -86,3 +86,13 @@ go build \ -installsuffix "static" \ -ldflags "${LDFLAGS}" \ ${PKG}/cmd/${BIN} + +# verify fips +if [[ -z "${GOEXPERIMENT:-}" ]]; then + GOEXPERIMENT="" +fi +if [[ ${GOEXPERIMENT} = "boringcrypto" ]]; then + # workaround for broken pipe is to write to file and grep file + tempfile=$(mktemp) + (go tool nm ${OUTPUT} > ${tempfile} && grep ${tempfile} -qe crypto/internal/boring/fipstls.required && rm ${tempfile} && echo "FIPS verified for ${OUTPUT}") || (echo "FIPS not found in ${OUTPUT}" && rm ${tempfile} && exit 1) +fi diff --git a/hack/docker-push.sh b/hack/docker-push.sh index e503358c9f8..5372bbfc57f 100755 --- a/hack/docker-push.sh +++ b/hack/docker-push.sh @@ -92,6 +92,11 @@ if [[ -z "$BUILDX_PLATFORMS" ]]; then BUILDX_PLATFORMS="linux/amd64,linux/arm64" fi +# if SUFFIX is set, append it to the version +if [[ -n "$SUFFIX" ]]; then + VERSION="$VERSION-$SUFFIX" +fi + # Debugging info echo "Highest tag found: $HIGHEST" echo "BRANCH: $BRANCH"