Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Produce FIPS compliant ARM builds #10581

Closed
pschisa opened this issue Feb 24, 2022 · 3 comments
Closed

Produce FIPS compliant ARM builds #10581

pschisa opened this issue Feb 24, 2022 · 3 comments
Assignees
@reedloden
Labels
arm c-fw Internal Customer Reference c-kb Internal Customer Reference feature-request Used for new features in Teleport, improvements to current should be #enhancements fedramp release-engineering

Comments

@pschisa
Copy link
Contributor

pschisa commented Feb 24, 2022

Feature request to start offering ARM specific builds that are FEDRAMP/FIPS compliant like we do for DEB/RPM
@pschisa pschisa added feature-request Used for new features in Teleport, improvements to current should be #enhancements arm c-fw Internal Customer Reference labels Feb 24, 2022
@zmb3
Copy link
Collaborator

zmb3 commented Nov 9, 2022

We'll be able to support this soon.

https://go-review.googlesource.com/c/go/+/423362

@zmb3
Copy link
Collaborator

zmb3 commented Dec 7, 2022

This is now possible with Go 1.19.4

@wadells wadells mentioned this issue May 24, 2023
Merged
wadells added a commit that referenced this issue Jun 15, 2023
@wadells
Remove Dockerfile-arm-fips
4bcc846 
We don't build fips for arm, as documented in
#10581.
wadells added a commit that referenced this issue Jun 15, 2023
@wadells
Remove Dockerfile-arm-fips
c7ca5bb 
We don't build fips for arm, as documented in
#10581.
wadells added a commit that referenced this issue Jun 20, 2023
@wadells
Remove further unused fips infrastructure (#27900)
6ef1186 
* Remove Dockerfile-arm-fips

We don't build fips for arm, as documented in
#10581.

* Stop building buildbox-fips

We do not use this buildbox for anything. This step is failing because
the supporting infrastructure for buildbox-fips was removed in
#26859.

* Fix fips buildbox

BUILDBOX_FIPS was removed, replaced by BUILDBOX_CENTOS7_FIPS.
Unfortunately I missed updating this target in #26859.
This subsequently broke e CI.
@espadolini espadolini added the c-kb Internal Customer Reference label Jul 18, 2023
gzdunek pushed a commit that referenced this issue Sep 21, 2023
@wadells @gzdunek
Remove further unused fips infrastructure (#27900)
990717d 
* Remove Dockerfile-arm-fips

We don't build fips for arm, as documented in
#10581.

* Stop building buildbox-fips

We do not use this buildbox for anything. This step is failing because
the supporting infrastructure for buildbox-fips was removed in
#26859.

* Fix fips buildbox

BUILDBOX_FIPS was removed, replaced by BUILDBOX_CENTOS7_FIPS.
Unfortunately I missed updating this target in #26859.
This subsequently broke e CI.

(cherry picked from commit 6ef1186)
gzdunek pushed a commit that referenced this issue Sep 21, 2023
@wadells @gzdunek
Remove further unused fips infrastructure (#27900)
262049b 
* Remove Dockerfile-arm-fips

We don't build fips for arm, as documented in
#10581.

* Stop building buildbox-fips

We do not use this buildbox for anything. This step is failing because
the supporting infrastructure for buildbox-fips was removed in
#26859.

* Fix fips buildbox

BUILDBOX_FIPS was removed, replaced by BUILDBOX_CENTOS7_FIPS.
Unfortunately I missed updating this target in #26859.
This subsequently broke e CI.

(cherry picked from commit 6ef1186)
gzdunek pushed a commit that referenced this issue Sep 26, 2023
@wadells @gzdunek
Remove further unused fips infrastructure (#27900)
366ed90 
* Remove Dockerfile-arm-fips

We don't build fips for arm, as documented in
#10581.

* Stop building buildbox-fips

We do not use this buildbox for anything. This step is failing because
the supporting infrastructure for buildbox-fips was removed in
#26859.

* Fix fips buildbox

BUILDBOX_FIPS was removed, replaced by BUILDBOX_CENTOS7_FIPS.
Unfortunately I missed updating this target in #26859.
This subsequently broke e CI.

(cherry picked from commit 6ef1186)
gzdunek pushed a commit that referenced this issue Sep 26, 2023
@wadells @gzdunek
Remove further unused fips infrastructure (#27900)
73de7ac 
* Remove Dockerfile-arm-fips

We don't build fips for arm, as documented in
#10581.

* Stop building buildbox-fips

We do not use this buildbox for anything. This step is failing because
the supporting infrastructure for buildbox-fips was removed in
#26859.

* Fix fips buildbox

BUILDBOX_FIPS was removed, replaced by BUILDBOX_CENTOS7_FIPS.
Unfortunately I missed updating this target in #26859.
This subsequently broke e CI.

(cherry picked from commit 6ef1186)
github-merge-queue bot pushed a commit that referenced this issue Sep 26, 2023
@gzdunek @wadells
[v13] Remove unused FIPS infrastructure (#32539)
313b1cf 
* Remove unused FIPS build boxes (#26859)

FIPS is only built on amd64, and only on our centos:7 buildboxes.  These
other dockerfiles and targets are vestigial.  Furthermore, the buildbox
is a security risk, as ubuntu:18.04 is not supported after 2023-05-31.

If/when we want to support FIPS on ARM, we can build off the centos:7
infrastructure, or its successor.

(cherry picked from commit fafa16a)

* Remove further unused fips infrastructure (#27900)

* Remove Dockerfile-arm-fips

We don't build fips for arm, as documented in
#10581.

* Stop building buildbox-fips

We do not use this buildbox for anything. This step is failing because
the supporting infrastructure for buildbox-fips was removed in
#26859.

* Fix fips buildbox

BUILDBOX_FIPS was removed, replaced by BUILDBOX_CENTOS7_FIPS.
Unfortunately I missed updating this target in #26859.
This subsequently broke e CI.

(cherry picked from commit 6ef1186)

* Update signature

---------

Co-authored-by: Walt <walt@goteleport.com>
github-merge-queue bot pushed a commit that referenced this issue Sep 26, 2023
@gzdunek @wadells
[v12] Remove unused FIPS infrastructure (#32540)
5fe14d6 
* Remove unused FIPS build boxes (#26859)

FIPS is only built on amd64, and only on our centos:7 buildboxes.  These
other dockerfiles and targets are vestigial.  Furthermore, the buildbox
is a security risk, as ubuntu:18.04 is not supported after 2023-05-31.

If/when we want to support FIPS on ARM, we can build off the centos:7
infrastructure, or its successor.

(cherry picked from commit fafa16a)

* Remove further unused fips infrastructure (#27900)

* Remove Dockerfile-arm-fips

We don't build fips for arm, as documented in
#10581.

* Stop building buildbox-fips

We do not use this buildbox for anything. This step is failing because
the supporting infrastructure for buildbox-fips was removed in
#26859.

* Fix fips buildbox

BUILDBOX_FIPS was removed, replaced by BUILDBOX_CENTOS7_FIPS.
Unfortunately I missed updating this target in #26859.
This subsequently broke e CI.

(cherry picked from commit 6ef1186)

* Update signature

---------

Co-authored-by: Walt <walt@goteleport.com>
@reedloden reedloden mentioned this issue Nov 24, 2023
Merged
reedloden added a commit that referenced this issue Dec 12, 2023
@reedloden
Simplify Dockerfile-centos7-fips and prepare for FIPS arm64 builds
23b28fa 
Replace `Dockerfile-centos7-fips` with a simple version that just uses
the existing `Dockerfile-centos7` image with some extra modifications
(specifically, enabling BoringCrypto for Go and configuring OpenSSL to
use FIPS mode).

Several changes were made to `Dockerfile-centos7` to support this.

There is a mix of `public.ecr.aws` and `ghcr.io` being used for the
buildboxes. The default now uses `ghcr.io`.

Buildbox images did not handle varying architectures well, so use
docker buildx multi-architecture support to make it easy to target
specific architectures. `--platform` usage has been removed for
the time being, as it wasn't correctly implemented.

Additionally, start building arm and CentOS 7 FIPS buildbox images
in GHA to bring it in sync with `dronegen/buildbox.go`.

This does not include any drone/dronegen changes yet. Changes will
come in a separate PR once this groundwork has been done.

Ref #5068.
Ref #10581.
reedloden added a commit that referenced this issue Dec 19, 2023
@reedloden
Simplify Dockerfile-centos7-fips and prepare for FIPS arm64 builds
7a97334 
Replace `Dockerfile-centos7-fips` with a simple version that just uses
the existing `Dockerfile-centos7` image with some extra modifications
(specifically, enabling BoringCrypto for Go and configuring OpenSSL to
use FIPS mode).

Several changes were made to `Dockerfile-centos7` to support this.

There is a mix of `public.ecr.aws` and `ghcr.io` being used for the
buildboxes. The default now uses `ghcr.io`.

Buildbox images did not handle varying architectures well, so use
docker buildx multi-architecture support to make it easy to target
specific architectures. `--platform` usage has been removed for
the time being, as it wasn't correctly implemented.

Additionally, start building arm and CentOS 7 FIPS buildbox images
in GHA to bring it in sync with `dronegen/buildbox.go`.

This does not include any drone/dronegen changes yet. Changes will
come in a separate PR once this groundwork has been done.

Ref #5068.
Ref #10581.
github-merge-queue bot pushed a commit that referenced this issue Dec 19, 2023
@reedloden
Simplify Dockerfile-centos7-fips and prepare for FIPS arm64 builds (#…
fc880f1 
…34950)

Replace `Dockerfile-centos7-fips` with a simple version that just uses
the existing `Dockerfile-centos7` image with some extra modifications
(specifically, enabling BoringCrypto for Go and configuring OpenSSL to
use FIPS mode).

Several changes were made to `Dockerfile-centos7` to support this.

There is a mix of `public.ecr.aws` and `ghcr.io` being used for the
buildboxes. The default now uses `ghcr.io`.

Buildbox images did not handle varying architectures well, so use
docker buildx multi-architecture support to make it easy to target
specific architectures. `--platform` usage has been removed for
the time being, as it wasn't correctly implemented.

Additionally, start building arm and CentOS 7 FIPS buildbox images
in GHA to bring it in sync with `dronegen/buildbox.go`.

This does not include any drone/dronegen changes yet. Changes will
come in a separate PR once this groundwork has been done.

Ref #5068.
Ref #10581.
@reedloden reedloden mentioned this issue Dec 21, 2023
Merged
reedloden added a commit that referenced this issue Dec 23, 2023
@reedloden
Enable ARM64 FIPS builds in Drone
e9840c3 
Now that #34950 and gravitational/teleport.e#2729 have landed, we can
now release arm64-based FIPS builds. Add the appropriate magic to
dronegen and run `make dronegen` to update `.drone.yml`.

Ref #5068.
Ref #10581.
github-merge-queue bot pushed a commit that referenced this issue Dec 23, 2023
@reedloden
Enable ARM64 FIPS builds in Drone (#35958)
fc81024 
Now that #34950 and gravitational/teleport.e#2729 have landed, we can
now release arm64-based FIPS builds. Add the appropriate magic to
dronegen and run `make dronegen` to update `.drone.yml`.

Ref #5068.
Ref #10581.
@reedloden reedloden assigned reedloden and unassigned tcsc Dec 23, 2023
@reedloden
Copy link
Contributor

Teleport 15 will have ARM64 FIPS builds.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@reedloden reedloden

Labels
arm c-fw Internal Customer Reference c-kb Internal Customer Reference feature-request Used for new features in Teleport, improvements to current should be #enhancements fedramp release-engineering
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
5 participants
@reedloden @espadolini @tcsc @zmb3 @pschisa