Skip to content

Conversation

@braydonk
Copy link
Contributor

@braydonk braydonk commented Sep 16, 2025

This is the same PR as #415 but I'm renaming the branch to run the build experiment.


This PR adds a new distrogen option for boringcrypto which will enable the distribution to be built with boringcrypto enabled. This option is now enabled in the google-built-opentelemetry-collector distribution as well.

The alternate build container option has been changed from ubuntu to debian. I think this is a better base because it is similar to the default go container other Go developers may be used to. These changes are more open source distrogen related and don't affect anything internally to Google-Built OpenTelemetry Collector.

Testing

Leveraging the -experiment- workflows, I built a container image from this branch. I pulled the image down on a COS VM and copied the binary out of the container.

$ file otelcol-google
otelcol-google: ELF 64-bit LSB executable, x86-64, version 1 (GNU/Linux), statically linked, BuildID[sha1]=356fef950ee1021a68a3d2d761f41696b4da7b94, for GNU/Linux 3.2.0, with debug_info, not stripped

In that build, I didn't strip the symbols. This was so I could use go tool nm to verify that boringcrypto is being used:

$ sudo -E docker run --rm -v "$PWD":/app -w /app golang:latest go tool nm otelcol-google | grep _Cfunc__goboringcrypto_
 5a368a0 T _cgo_39a3e70c2c46_Cfunc__goboringcrypto_AES_cbc_encrypt
 5a368c0 T _cgo_39a3e70c2c46_Cfunc__goboringcrypto_AES_ctr128_encrypt
 5a368f0 T _cgo_39a3e70c2c46_Cfunc__goboringcrypto_AES_decrypt
 5a36900 T _cgo_39a3e70c2c46_Cfunc__goboringcrypto_AES_encrypt
 5a36910 T _cgo_39a3e70c2c46_Cfunc__goboringcrypto_AES_set_decrypt_key
 5a36950 T _cgo_39a3e70c2c46_Cfunc__goboringcrypto_AES_set_encrypt_key
 5a36b60 T _cgo_39a3e70c2c46_Cfunc__goboringcrypto_BN_bin2bn
 5a36ca0 T _cgo_39a3e70c2c46_Cfunc__goboringcrypto_BN_bn2bin_padded
 5a36ba0 T _cgo_39a3e70c2c46_Cfunc__goboringcrypto_BN_bn2le_padded
 5a36be0 T _cgo_39a3e70c2c46_Cfunc__goboringcrypto_BN_free
 5a36bf0 T _cgo_39a3e70c2c46_Cfunc__goboringcrypto_BN_le2bn
 5a36ce0 T _cgo_39a3e70c2c46_Cfunc__goboringcrypto_BN_new
 5a36c30 T _cgo_39a3e70c2c46_Cfunc__goboringcrypto_BN_num_bytes
 5a36c60 T _cgo_39a3e70c2c46_Cfunc__goboringcrypto_BORINGSSL_bcm_power_on_self_test
 5a36f90 T _cgo_39a3e70c2c46_Cfunc__goboringcrypto_ECDSA_sign
 5a36fd0 T _cgo_39a3e70c2c46_Cfunc__goboringcrypto_ECDSA_size
 5a37000 T _cgo_39a3e70c2c46_Cfunc__goboringcrypto_ECDSA_verify
 5a36d10 T _cgo_39a3e70c2c46_Cfunc__goboringcrypto_EC_GROUP_free
 5a36d20 T _cgo_39a3e70c2c46_Cfunc__goboringcrypto_EC_GROUP_new_by_curve_name
 5a36d50 T _cgo_39a3e70c2c46_Cfunc__goboringcrypto_EC_KEY_free
 5a36d60 T _cgo_39a3e70c2c46_Cfunc__goboringcrypto_EC_KEY_generate_key_fips
...

I also ran the container with the same config as smoke tests, and saw the same telemetry get sent all as expected.

This change to using CGO and adding BoringCrypto seems to add about 10 minutes to the container build time. It adds around 3M to the binary size.

$ du -h no-boring/otelcol-google
181M    no-boring/otelcol-google
$ du -h boring/otelcol-google
184M    boring/otelcol-google

@braydonk braydonk merged commit 9d602eb into master Sep 18, 2025
10 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants