Provide boring crypto builds for FIPS

.github/workflows/build.yaml

@@ -1,3 +1,17 @@
+# Copyright 2020 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
 name: Build
 
 on:

.github/workflows/release.yaml

@@ -1,3 +1,17 @@
+# Copyright 2020 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
 name: Release
 
 on:
@@ -15,15 +29,26 @@ jobs:
         with:
           fetch-depth: 0
       -
-        name: Set up Go
-        uses: actions/setup-go@v2
-        with:
-          go-version: 1.14
-      -
-        name: Run GoReleaser
-        uses: goreleaser/goreleaser-action@v2
+        name: Run Goreleaser on Goboring docker image
+        uses: docker/build-push-action@v1
         with:
-          version: latest
-          args: release --rm-dist
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          repository: build/goboring
+          dockerfile: Dockerfile_releaser
+          registry: gcr.io
+          push: false
+          build_args: GITHUB_TOKEN=${{ secrets.GITHUB_TOKEN }}
+
+      # local Goreleaser run would be per below
+      # -
+      #   name: Set up Go
+      #   uses: actions/setup-go@v2
+      #   with:
+      #     go-version: 1.14
+      # -
+      #   name: Run GoReleaser
+      #   uses: goreleaser/goreleaser-action@v2
+      #   with:
+      #     version: latest
+      #     args: release --rm-dist
+      #   env:
+      #     GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.goreleaser.yaml

@@ -13,20 +13,46 @@
 # limitations under the License.
 
 builds:
-  - goos:
+  - id: default
+    main: main.go
+    goos:
       - windows
       - darwin
       - linux
     goarch:
       - amd64
+    env:
+      - CGO_ENABLED=0
+  - id: goboring
+    main: main.go
+    goos:
+      - linux
+    goarch:
+      - amd64
+    env:
+      # - CGO_ENABLED=1 # note: set in Dockerfile_releaser instead of here
+
 archives:
-  - format: tar.gz
+  - id: default
+    format: tar.gz
     replacements:
       darwin: macOS
       amd64: 64-bit
     files:
       - LICENSE
       - README.md
+    builds:
+      - default
+  - id: goboring
+    format: tar.gz
+    replacements:
+      amd64: 64-bit_goboring
+    files:
+      - LICENSE
+      - README.md
+    builds:
+      - goboring
+
 release:
   draft: true
   prerelease: true

Dockerfile_releaser

@@ -0,0 +1,35 @@
+# Copyright 2020 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# Runs goreleaser to build linux version using Boring Crypto
+# Expects --build-arg GITHUB_TOKEN=
+
+# use following to build without Boring Crypto:
+# --build-arg CGO_ENABLED=0
+# --build-arg GO_CONTAINER=golang:1.14
+
+ARG GO_CONTAINER=goboring/golang:1.14.4b4
+FROM ${GO_CONTAINER}
+
+ARG GITHUB_TOKEN
+ARG CGO_ENABLED=1
+
+RUN curl -sfL https://install.goreleaser.com/github.com/goreleaser/goreleaser.sh | sh
+
+WORKDIR /app
+ADD . .
+
+RUN go mod download
+RUN GITHUB_TOKEN=$GITHUB_TOKEN CGO_ENABLED=$CGO_ENABLED goreleaser release --rm-dist
+# RUN CGO_ENABLED=$CGO_ENABLED goreleaser release --rm-dist --snapshot