Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

packages: build Go binaries for FIPS and non-FIPS #3887

Merged
merged 18 commits into from
Apr 30, 2024
Merged

packages: build Go binaries for FIPS and non-FIPS #3887

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
18 commits
Select commit Hold shift + click to select a range
4fca8e7
amazon-ssm-agent: build for FIPS and non-FIPS
bcressey Mar 9, 2024
bc40d95
aws-iam-authenticator: build for FIPS and non-FIPS
bcressey Mar 6, 2024
fc7157a
aws-signing-helper: build for FIPS and non-FIPS
bcressey Mar 6, 2024
2ca4fa1
cni: simplify go build invocation
bcressey Mar 11, 2024
2ac1f48
cni-plugins: build for FIPS and non-FIPS
bcressey Mar 11, 2024
f4ff8a0
containerd: build for FIPS and non-FIPS
bcressey Mar 6, 2024
c663004
docker-cli: build for FIPS and non-FIPS
bcressey Mar 9, 2024
e3af6d9
docker-engine: build for FIPS and non-FIPS
bcressey Mar 6, 2024
156e0e7
ecr-credential-provider: build for FIPS and non-FIPS
bcressey Mar 11, 2024
948e132
ecs-agent: build for FIPS and non-FIPS
bcressey Mar 9, 2024
cd746c3
host-ctr: build for FIPS and non-FIPS
bcressey Mar 6, 2024
ead001c
kubelet: build for FIPS and non-FIPS
bcressey Mar 6, 2024
526540c
nvidia-container-toolkit: simplify go build invocation
bcressey Mar 11, 2024
0d47953
nvidia-k8s-device-plugin: build for FIPS and non-FIPS
bcressey Mar 6, 2024
8f8eff6
oci-add-hooks: simplify go build invocation
bcressey Mar 11, 2024
ad66abd
runc: build for FIPS and non-FIPS
bcressey Mar 9, 2024
2a871a0
filesystem: add directories for FIPS binaries
bcressey Mar 12, 2024
2a0f446
selinux-policy: label FIPS binaries
bcressey Mar 6, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
51 changes: 42 additions & 9 deletions packages/amazon-ssm-agent/amazon-ssm-agent.spec
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,8 +1,3 @@
# Don't generate debug packages because we are compiling without CGO,
# and the `gc` compiler doesn't append the the ".note.gnu.build-id" section
# https://fedoraproject.org/wiki/PackagingDrafts/Go#Build_ID
%global debug_package %{nil}

%global goproject github.com/aws
%global gorepo amazon-ssm-agent
%global goimport %{goproject}/%{gorepo}
Expand All @@ -17,10 +12,29 @@ Source0: %{gorepo}-%{version}.tar.gz
Source1000: clarify.toml

BuildRequires: %{_cross_os}glibc-devel
Requires: %{name}(binaries)
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Each top-level package now depends on a capability like this to ensure that its binaries are installed - since the package wouldn't be very useful without those!


%description
%{summary}.

%package bin
Summary: Remote management agent binaries
Provides: %{name}(binaries)
Requires: (%{_cross_os}image-feature(no-fips) and %{name})
Conflicts: (%{_cross_os}image-feature(fips) or %{name}-fips-bin)
Comment on lines +20 to +24
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Each binary package provides the %{name}(binaries) capability that the top-level package needs.

It requires the top-level package (so that dnf install bottlerocket-runc-bin also installs bottlerocket-runc) as well as the corresponding image feature capability from the metadata package. This will either be "fips" or "no-fips" depending on the variant.

Finally, it conflicts with the opposite image feature or the other binary package. The conflict helps the package manager eliminate the "wrong" package from consideration, and also prevents bottlerocket-runc-bin and bottlerocket-runc-fips-bin from being installed together.


%description bin
%{summary}.

%package fips-bin
Summary: Remote management agent binaries, FIPS edition
Provides: %{name}(binaries)
Requires: (%{_cross_os}image-feature(fips) and %{name})
Conflicts: (%{_cross_os}image-feature(no-fips) or %{name}-bin)
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

What does this part prevent?

or %{name}-bin

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

What does this part prevent?


or %{name}-bin

It's meant to prevent the bin and fips-bin packages from both being installed, since only one set of binaries would end up in use.

It's a bit redundant but hypothetically nothing stops someone from adding Provides: %{_cross_os}image-feature(fips) to a random package in their variant that doesn't have that feature set. So even if that happened, this would force only one of the two packages to be installed.


%description fips-bin
%{summary}.

%prep
%setup -n %{gorepo}-%{version}

Expand All @@ -30,25 +44,44 @@ BuildRequires: %{_cross_os}glibc-devel
go build -ldflags "${GOLDFLAGS}" -o amazon-ssm-agent \
./core/agent.go ./core/agent_unix.go ./core/agent_parser.go

gofips build -ldflags "${GOLDFLAGS}" -o fips/amazon-ssm-agent \
./core/agent.go ./core/agent_unix.go ./core/agent_parser.go

go build -ldflags "${GOLDFLAGS}" -o ssm-agent-worker \
./agent/agent.go ./agent/agent_unix.go ./agent/agent_parser.go

gofips build -ldflags "${GOLDFLAGS}" -o fips/ssm-agent-worker \
./agent/agent.go ./agent/agent_unix.go ./agent/agent_parser.go

go build -ldflags "${GOLDFLAGS}" -o ssm-session-worker \
./agent/framework/processor/executer/outofproc/sessionworker/main.go

gofips build -ldflags "${GOLDFLAGS}" -o fips/ssm-session-worker \
./agent/framework/processor/executer/outofproc/sessionworker/main.go

%install
# Install the SSM agent under 'libexecdir', since it is meant to be used by other programs
install -d %{buildroot}%{_cross_libexecdir}/amazon-ssm-agent/bin/%{version}
install -d %{buildroot}{%{_cross_libexecdir},%{_cross_fips_libexecdir}}/amazon-ssm-agent/bin/%{version}
for b in amazon-ssm-agent ssm-agent-worker ssm-session-worker; do
install -D -p -m 0755 ${b} %{buildroot}%{_cross_libexecdir}/amazon-ssm-agent/bin/%{version}
install -p -m 0755 ${b} %{buildroot}%{_cross_libexecdir}/amazon-ssm-agent/bin/%{version}
install -p -m 0755 fips/${b} %{buildroot}%{_cross_fips_libexecdir}/amazon-ssm-agent/bin/%{version}
done


%cross_scan_attribution --clarify %{S:1000} go-vendor vendor

%files
%license LICENSE
%{_cross_attribution_file}
%{_cross_attribution_vendor_dir}

%files bin
%dir %{_cross_libexecdir}/amazon-ssm-agent
%{_cross_libexecdir}/amazon-ssm-agent
%{_cross_libexecdir}/amazon-ssm-agent/bin/%{version}/amazon-ssm-agent
%{_cross_libexecdir}/amazon-ssm-agent/bin/%{version}/ssm-agent-worker
%{_cross_libexecdir}/amazon-ssm-agent/bin/%{version}/ssm-session-worker

%files fips-bin
%dir %{_cross_fips_libexecdir}/amazon-ssm-agent
%{_cross_fips_libexecdir}/amazon-ssm-agent/bin/%{version}/amazon-ssm-agent
%{_cross_fips_libexecdir}/amazon-ssm-agent/bin/%{version}/ssm-agent-worker
%{_cross_fips_libexecdir}/amazon-ssm-agent/bin/%{version}/ssm-session-worker
30 changes: 29 additions & 1 deletion packages/aws-iam-authenticator/aws-iam-authenticator.spec
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,28 +19,56 @@ Source1000: clarify.toml

BuildRequires: git
BuildRequires: %{_cross_os}glibc-devel
Requires: %{name}(binaries)

%description
%{summary}.

%package bin
Summary: AWS IAM authenticator binaries
Provides: %{name}(binaries)
Requires: (%{_cross_os}image-feature(no-fips) and %{name})
Conflicts: (%{_cross_os}image-feature(fips) or %{name}-fips-bin)

%description bin
%{summary}.

%package fips-bin
Summary: AWS IAM authenticator binaries, FIPS edition
Provides: %{name}(binaries)
Requires: (%{_cross_os}image-feature(fips) and %{name})
Conflicts: (%{_cross_os}image-feature(no-fips) or %{name}-bin)

%description fips-bin
%{summary}.

%prep
%setup -n %{gorepo}-%{gover} -q
%setup -T -D -n %{gorepo}-%{version} -b 1

%build
%set_cross_go_flags
go build -buildmode=pie -ldflags="${GOLDFLAGS}" -o aws-iam-authenticator ./cmd/aws-iam-authenticator
go build -ldflags="${GOLDFLAGS}" -o aws-iam-authenticator ./cmd/aws-iam-authenticator
gofips build -ldflags="${GOLDFLAGS}" -o fips/aws-iam-authenticator ./cmd/aws-iam-authenticator

%install
install -d %{buildroot}%{_cross_bindir}
install -p -m 0755 aws-iam-authenticator %{buildroot}%{_cross_bindir}

install -d %{buildroot}%{_cross_fips_bindir}
install -p -m 0755 fips/aws-iam-authenticator %{buildroot}%{_cross_fips_bindir}

%cross_scan_attribution --clarify %{S:1000} go-vendor vendor

%files
%license LICENSE
%{_cross_attribution_file}
%{_cross_attribution_vendor_dir}

%files bin
%{_cross_bindir}/aws-iam-authenticator

%files fips-bin
%{_cross_fips_bindir}/aws-iam-authenticator

%changelog
32 changes: 31 additions & 1 deletion packages/aws-signing-helper/aws-signing-helper.spec
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,29 +18,59 @@ Source: rolesanywhere-credential-helper-v%{gover}.tar.gz
Source1: bundled-rolesanywhere-credential-helper-v%{gover}.tar.gz

BuildRequires: %{_cross_os}glibc-devel
Requires: %{name}(binaries)

%description
%{summary}.

%package bin
Summary: AWS signing helper binaries
Provides: %{name}(binaries)
Requires: (%{_cross_os}image-feature(no-fips) and %{name})
Conflicts: (%{_cross_os}image-feature(fips) or %{name}-fips-bin)

%description bin
%{summary}.

%package fips-bin
Summary: AWS signing helper binaries, FIPS edition
Provides: %{name}(binaries)
Requires: (%{_cross_os}image-feature(fips) and %{name})
Conflicts: (%{_cross_os}image-feature(no-fips) or %{name}-bin)

%description fips-bin
%{summary}.

%prep
%setup -n %{gorepo}-%{gover} -q
%setup -T -D -n %{gorepo}-%{gover} -b 1 -q

%build
%set_cross_go_flags

go build ${GOFLAGS} -buildmode=pie -ldflags "-X 'main.Version=${gover}' ${GOLDFLAGS}" -o aws-signing-helper main.go
go build -ldflags "-X 'main.Version=${gover}' ${GOLDFLAGS}" -o aws-signing-helper main.go
gofips build -ldflags "-X 'main.Version=${gover}' ${GOLDFLAGS}" -o fips/aws-signing-helper main.go

%install
install -d %{buildroot}%{_cross_bindir}
install -p -m 0755 aws-signing-helper %{buildroot}%{_cross_bindir}/aws_signing_helper
ln -sf aws_signing_helper %{buildroot}%{_cross_bindir}/aws-signing-helper

install -d %{buildroot}%{_cross_fips_bindir}
install -p -m 0755 fips/aws-signing-helper %{buildroot}%{_cross_fips_bindir}/aws_signing_helper
ln -sf aws_signing_helper %{buildroot}%{_cross_fips_bindir}/aws-signing-helper

%cross_scan_attribution go-vendor vendor

%files
%license LICENSE
%{_cross_attribution_file}
%{_cross_attribution_vendor_dir}

%files bin
%{_cross_bindir}/aws_signing_helper
%{_cross_bindir}/aws-signing-helper

%files fips-bin
%{_cross_fips_bindir}/aws_signing_helper
%{_cross_fips_bindir}/aws-signing-helper
49 changes: 47 additions & 2 deletions packages/cni-plugins/cni-plugins.spec
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,24 +18,47 @@ Source1: cni-plugins-tmpfiles.conf
BuildRequires: git
BuildRequires: %{_cross_os}glibc-devel
Requires: %{_cross_os}iptables
Requires: %{name}(binaries)

%description
%{summary}.

%package bin
Summary: Plugins for container networking binaries
Provides: %{name}(binaries)
Requires: (%{_cross_os}image-feature(no-fips) and %{name})
Conflicts: (%{_cross_os}image-feature(fips) or %{name}-fips-bin)

%description bin
%{summary}.

%package fips-bin
Summary: Plugins for container networking binaries, FIPS edition
Provides: %{name}(binaries)
Requires: (%{_cross_os}image-feature(fips) and %{name})
Conflicts: (%{_cross_os}image-feature(no-fips) or %{name}-bin)

%description fips-bin
%{summary}.

%prep
%autosetup -Sgit -n %{gorepo}-%{gover} -p1
%cross_go_setup %{gorepo}-%{gover} %{goproject} %{goimport}

%build
%cross_go_configure %{goimport}
for d in $(find plugins -mindepth 2 -maxdepth 2 -type d ! -name windows) ; do
go build -buildmode=pie -ldflags="${GOLDFLAGS}" -o "bin/${d##*/}" %{goimport}/${d}
go build -ldflags="${GOLDFLAGS}" -o "bin/${d##*/}" %{goimport}/${d}
gofips build -ldflags="${GOLDFLAGS}" -o "fips/bin/${d##*/}" %{goimport}/${d}
done

%install
install -d %{buildroot}%{_cross_libexecdir}/cni/bin
install -p -m 0755 bin/* %{buildroot}%{_cross_libexecdir}/cni/bin

install -d %{buildroot}%{_cross_fips_libexecdir}/cni/bin
install -p -m 0755 fips/bin/* %{buildroot}%{_cross_fips_libexecdir}/cni/bin

install -d %{buildroot}%{_cross_tmpfilesdir}
install -p -m 0644 %{S:1} %{buildroot}%{_cross_tmpfilesdir}/cni-plugins.conf

Expand All @@ -45,6 +68,9 @@ install -p -m 0644 %{S:1} %{buildroot}%{_cross_tmpfilesdir}/cni-plugins.conf
%license LICENSE
%{_cross_attribution_file}
%{_cross_attribution_vendor_dir}
%{_cross_tmpfilesdir}/cni-plugins.conf

%files bin
%{_cross_libexecdir}/cni/bin/loopback
%{_cross_libexecdir}/cni/bin/bandwidth
%{_cross_libexecdir}/cni/bin/bridge
Expand All @@ -63,6 +89,25 @@ install -p -m 0644 %{S:1} %{buildroot}%{_cross_tmpfilesdir}/cni-plugins.conf
%{_cross_libexecdir}/cni/bin/tuning
%{_cross_libexecdir}/cni/bin/vlan
%{_cross_libexecdir}/cni/bin/vrf
%{_cross_tmpfilesdir}/cni-plugins.conf

%files fips-bin
%{_cross_fips_libexecdir}/cni/bin/loopback
%{_cross_fips_libexecdir}/cni/bin/bandwidth
%{_cross_fips_libexecdir}/cni/bin/bridge
%{_cross_fips_libexecdir}/cni/bin/dhcp
%{_cross_fips_libexecdir}/cni/bin/dummy
%{_cross_fips_libexecdir}/cni/bin/firewall
%{_cross_fips_libexecdir}/cni/bin/host-device
%{_cross_fips_libexecdir}/cni/bin/host-local
%{_cross_fips_libexecdir}/cni/bin/ipvlan
%{_cross_fips_libexecdir}/cni/bin/macvlan
%{_cross_fips_libexecdir}/cni/bin/portmap
%{_cross_fips_libexecdir}/cni/bin/ptp
%{_cross_fips_libexecdir}/cni/bin/sbr
%{_cross_fips_libexecdir}/cni/bin/static
%{_cross_fips_libexecdir}/cni/bin/tap
%{_cross_fips_libexecdir}/cni/bin/tuning
%{_cross_fips_libexecdir}/cni/bin/vlan
%{_cross_fips_libexecdir}/cni/bin/vrf

%changelog
2 changes: 1 addition & 1 deletion packages/cni/cni.spec
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,7 +29,7 @@ Requires: %{_cross_os}iptables
%build
%set_cross_go_flags

go build -buildmode=pie -ldflags="${GOLDFLAGS}" -o "bin/cnitool" %{goimport}/cnitool
go build -ldflags="${GOLDFLAGS}" -o "bin/cnitool" %{goimport}/cnitool
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

No fips version for this package?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

No fips version for this package?

It doesn't import crypto/tls, so it doesn't need it. oci-add-hooks and ecs-gpu-init were the same way.


%install
install -d %{buildroot}%{_cross_libexecdir}/cni/bin
Expand Down
Loading