Skip to content

Commit 175fa7e

Browse files
bugerclaude
buger
and
claude
authored
feat(ci): FIPS base image for FIPS Docker builds + Go 1.25 (#963)
* feat(ci): FIPS base image for FIPS Docker builds + Go 1.25 Regenerated CI files from gromit policy (gromit#444). Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * feat(ci): FIPS base image for FIPS Docker builds + Go 1.25 Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
1 parent 93fcdd6 commit 175fa7e

File tree

4 files changed

+85
-49
lines changed

4 files changed

+85
-49
lines changed

‎.github/workflows/release.yml‎

Lines changed: 59 additions & 42 deletions
Original file line numberDiff line numberDiff line change
@@ -22,10 +22,6 @@ on:
2222
- release-**
2323
tags:
2424
- 'v*'
25-
26-
permissions:
27-
contents: read
28-
2925
env:
3026
GOPRIVATE: github.com/TykTechnologies
3127
VARIATION: prod-variation
@@ -34,10 +30,17 @@ env:
3430
# startsWith covers pull_request_target too
3531
BASE_REF: ${{startsWith(github.event_name, 'pull_request') && github.base_ref || github.ref_name}}
3632
jobs:
33+
dep-guard:
34+
if: github.event_name == 'pull_request'
35+
uses: TykTechnologies/github-actions/.github/workflows/dependency-guard.yml@d3fa20888fa2878e877e22bb7702141217290e7c # main
36+
permissions:
37+
contents: read
3738
goreleaser:
39+
needs:
40+
- dep-guard
3841
if: github.event.pull_request.draft == false
3942
name: '${{ matrix.golang_cross }}'
40-
runs-on: warp-ubuntu-latest-x64-4x
43+
runs-on: ${{ vars.DEFAULT_RUNNER }}
4144
permissions:
4245
id-token: write # AWS OIDC JWT
4346
contents: read # actions/checkout
@@ -71,8 +74,8 @@ jobs:
7174
echo "branch=${HEAD_REF##*/}" >> $GITHUB_OUTPUT
7275
- uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3
7376
- uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
77+
- uses: sigstore/cosign-installer@d7d6bc7722e3daa8354c50bcb52f4837da5e9b6a # v3
7478
- name: Login to DockerHub
75-
if: startsWith(github.ref, 'refs/tags')
7679
uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
7780
with:
7881
username: ${{ secrets.DOCKER_USERNAME }}
@@ -84,6 +87,18 @@ jobs:
8487
registry: docker.tyk.io
8588
username: ${{ secrets.CLOUDSMITH_USERNAME }}
8689
password: ${{ secrets.CLOUDSMITH_API_KEY }}
90+
- uses: aws-actions/configure-aws-credentials@ff717079ee2060e4bcee96c4779b553acc87447c # v4
91+
with:
92+
role-to-assume: arn:aws:iam::754489498669:role/ecr_rw_tyk
93+
role-session-name: cipush
94+
aws-region: eu-central-1
95+
# Don't mask to pass it across job boundaries
96+
mask-aws-account-id: false
97+
- uses: aws-actions/amazon-ecr-login@f2e9fc6c2b355c1890b65e6f6f0e2ac3e6e22f78 # v2
98+
id: ecr
99+
if: ${{ matrix.golang_cross == '1.25-bookworm' }}
100+
with:
101+
mask-password: 'true'
87102
- uses: WarpBuilds/cache@f643a1ba29942d56621d07fc2d4284c7219868ad # v1
88103
with:
89104
path: |
@@ -104,7 +119,6 @@ jobs:
104119
git config --global --add safe.directory /go/src/github.com/TykTechnologies/tyk-pump
105120
goreleaser release --clean -f ${{ matrix.goreleaser }} ${{ !startsWith(github.ref, 'refs/tags/') && ' --snapshot --skip=sign,docker' || '--skip=docker' }}' | tee /tmp/build.sh
106121
chmod +x /tmp/build.sh
107-
mkdir -p ~/.docker && echo "{}" > ~/.docker/config.json
108122
docker run --rm --privileged -e GITHUB_TOKEN=${{ github.token }} \
109123
-e GOPRIVATE=github.com/TykTechnologies \
110124
-e DEBVERS='${{ matrix.debvers }}' \
@@ -124,18 +138,6 @@ jobs:
124138
-v /tmp/build.sh:/tmp/build.sh \
125139
-w /go/src/github.com/TykTechnologies/tyk-pump \
126140
tykio/golang-cross:${{ matrix.golang_cross }} /tmp/build.sh
127-
- uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a # v4
128-
with:
129-
role-to-assume: arn:aws:iam::754489498669:role/ecr_rw_tyk
130-
role-session-name: cipush
131-
aws-region: eu-central-1
132-
# Don't mask to pass it across job boundaries
133-
mask-aws-account-id: false
134-
- uses: aws-actions/amazon-ecr-login@183a1442edf41672e66566b7fc560e297a290896 # v2
135-
id: ecr
136-
if: ${{ matrix.golang_cross == '1.25-bookworm' }}
137-
with:
138-
mask-password: 'true'
139141
- name: Docker metadata for fips CI
140142
id: ci_metadata_fips
141143
if: ${{ matrix.golang_cross == '1.25-bookworm' }}
@@ -168,6 +170,7 @@ jobs:
168170
labels: ${{ steps.ci_metadata_fips.outputs.labels }}
169171
build-args: |
170172
BUILD_PACKAGE_NAME=tyk-pump-fips
173+
BASE_IMAGE=tykio/dhi-busybox:1.37-fips
171174
- name: Docker metadata for fips tag push
172175
id: tag_metadata_fips
173176
uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5
@@ -182,7 +185,7 @@ jobs:
182185
type=semver,pattern={{version}}
183186
labels: |
184187
org.opencontainers.image.title=Tyk Analytics Pump FIPS
185-
org.opencontainers.image.description=Tyk Analytics Pump to move analytics data from Redis to any supported back end (multiple back ends can be written to at once). This version is compiled with boringssl.
188+
org.opencontainers.image.description=Tyk Analytics Pump to move analytics data from Redis to any supported back end (multiple back ends can be written to at once). Built with FIPS 140-3 compliant cryptography.
186189
org.opencontainers.image.vendor=tyk.io
187190
org.opencontainers.image.version=${{ github.ref_name }}
188191
- name: push fips image to prod
@@ -201,6 +204,19 @@ jobs:
201204
labels: ${{ steps.tag_metadata_fips.outputs.labels }}
202205
build-args: |
203206
BUILD_PACKAGE_NAME=tyk-pump-fips
207+
BASE_IMAGE=tykio/dhi-busybox:1.37-fips
208+
- name: Attach base image VEX to fips
209+
if: ${{ matrix.golang_cross == '1.25-bookworm' && startsWith(github.ref, 'refs/tags') }}
210+
run: |
211+
# Install Docker Scout CLI
212+
curl -fsSL https://raw.githubusercontent.com/docker/scout-cli/v1.20.4/install.sh -o /tmp/scout-install.sh && sh /tmp/scout-install.sh 2>/dev/null
213+
# Extract VEX from the DHI base image
214+
docker scout vex get --org tykio -o /tmp/fips-vex.json tykio/dhi-busybox:1.37-fips || true
215+
if [ -f /tmp/fips-vex.json ]; then
216+
cosign attest --yes --type openvex \
217+
--predicate /tmp/fips-vex.json \
218+
tykio/tyk-pump-fips:${{ github.ref_name }} || true
219+
fi
204220
- name: Docker metadata for std CI
205221
id: ci_metadata_std
206222
if: ${{ matrix.golang_cross == '1.25-bookworm' }}
@@ -222,7 +238,7 @@ jobs:
222238
uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6
223239
with:
224240
context: "dist"
225-
platforms: linux/amd64,linux/arm64,linux/s390x
241+
platforms: linux/amd64,linux/arm64
226242
file: ci/Dockerfile.distroless
227243
provenance: mode=max
228244
sbom: true
@@ -256,7 +272,7 @@ jobs:
256272
uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6
257273
with:
258274
context: "dist"
259-
platforms: linux/amd64,linux/arm64,linux/s390x
275+
platforms: linux/amd64,linux/arm64
260276
file: ci/Dockerfile.distroless
261277
provenance: mode=max
262278
sbom: true
@@ -291,14 +307,14 @@ jobs:
291307
if: github.event.pull_request.draft == false
292308
needs:
293309
- goreleaser
294-
runs-on: warp-ubuntu-latest-x64-2x
310+
runs-on: ${{ vars.DEFAULT_RUNNER }}
295311
outputs:
296312
envfiles: ${{ steps.params.outputs.envfiles }}
297313
pump: ${{ steps.params.outputs.pump }}
298314
sink: ${{ steps.params.outputs.sink }}
299315
steps:
300316
- name: Set test parameters
301-
uses: TykTechnologies/github-actions/.github/actions/tests/test-controller@d3fa20888fa2878e877e22bb7702141217290e7c # main
317+
uses: TykTechnologies/github-actions/.github/actions/tests/test-controller@42304edda365365e0a887cf018d8edc34b960b82 # main
302318
id: params
303319
with:
304320
variation: ${{ env.VARIATION }}
@@ -308,7 +324,7 @@ jobs:
308324
needs:
309325
- test-controller-api
310326
- goreleaser
311-
runs-on: warp-ubuntu-latest-x64-4x
327+
runs-on: ${{ vars.DEFAULT_RUNNER }}
312328
env:
313329
XUNIT_REPORT_PATH: ${{ github.workspace}}/test-results.xml
314330
permissions:
@@ -320,13 +336,13 @@ jobs:
320336
envfiles: ${{ fromJson(needs.test-controller-api.outputs.envfiles) }}
321337
sink: ${{ fromJson(needs.test-controller-api.outputs.sink) }}
322338
steps:
323-
- uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a # v4
339+
- uses: aws-actions/configure-aws-credentials@ff717079ee2060e4bcee96c4779b553acc87447c # v4
324340
with:
325341
role-to-assume: arn:aws:iam::754489498669:role/ecr_rw_tyk
326342
role-session-name: cipush
327343
aws-region: eu-central-1
328344
- id: ecr
329-
uses: aws-actions/amazon-ecr-login@183a1442edf41672e66566b7fc560e297a290896 # v2
345+
uses: aws-actions/amazon-ecr-login@f2e9fc6c2b355c1890b65e6f6f0e2ac3e6e22f78 # v2
330346
with:
331347
mask-password: 'true'
332348
- name: Setup tmate session only in debug mode
@@ -338,11 +354,11 @@ jobs:
338354
# Only ${{ github.actor }} has access
339355
# See https://github.com/mxschmitt/action-tmate#use-registered-public-ssh-keys
340356
- name: Fetch environment from tyk-pro
341-
uses: TykTechnologies/github-actions/.github/actions/tests/checkout-tyk-pro@d3fa20888fa2878e877e22bb7702141217290e7c # main
357+
uses: TykTechnologies/github-actions/.github/actions/tests/checkout-tyk-pro@42304edda365365e0a887cf018d8edc34b960b82 # main
342358
with:
343359
org_gh_token: ${{ github.token }}
344360
- name: Set up test environment
345-
uses: TykTechnologies/github-actions/.github/actions/tests/env-up@d3fa20888fa2878e877e22bb7702141217290e7c # main
361+
uses: TykTechnologies/github-actions/.github/actions/tests/env-up@42304edda365365e0a887cf018d8edc34b960b82 # main
346362
timeout-minutes: 5
347363
id: env_up
348364
with:
@@ -352,25 +368,25 @@ jobs:
352368
TYK_DB_LICENSEKEY: ${{ secrets.DASH_LICENSE }}
353369
TYK_MDCB_LICENSE: ${{ secrets.MDCB_LICENSE }}
354370
- name: Choose test code branch
355-
uses: TykTechnologies/github-actions/.github/actions/tests/choose-test-branch@d3fa20888fa2878e877e22bb7702141217290e7c # main
371+
uses: TykTechnologies/github-actions/.github/actions/tests/choose-test-branch@42304edda365365e0a887cf018d8edc34b960b82 # main
356372
with:
357373
test_folder: api
358374
org_gh_token: ${{ secrets.ORG_GH_TOKEN }}
359375
- name: Run API tests
360-
uses: TykTechnologies/github-actions/.github/actions/tests/api-tests@d3fa20888fa2878e877e22bb7702141217290e7c # main
376+
uses: TykTechnologies/github-actions/.github/actions/tests/api-tests@42304edda365365e0a887cf018d8edc34b960b82 # main
361377
timeout-minutes: 30
362378
id: test_execution
363379
with:
364380
user_api_secret: ${{ steps.env_up.outputs.USER_API_SECRET }}
365381
- name: Generate test reports and collect logs
366-
uses: TykTechnologies/github-actions/.github/actions/tests/reporting@d3fa20888fa2878e877e22bb7702141217290e7c # main
382+
uses: TykTechnologies/github-actions/.github/actions/tests/reporting@42304edda365365e0a887cf018d8edc34b960b82 # main
367383
if: always() && (steps.test_execution.conclusion != 'skipped')
368384
with:
369385
report_xml: 'true'
370386
execution_status: ${{ steps.test_execution.outcome }}
371387
aggregator-ci-test:
372388
name: Aggregated CI Status
373-
runs-on: warp-ubuntu-latest-x64-2x
389+
runs-on: ${{ vars.DEFAULT_RUNNER }}
374390
# Dynamically determine which jobs to depend on based on repository configuration
375391
needs: [goreleaser, api-tests]
376392
if: ${{ always() && github.event_name == 'pull_request' }}
@@ -393,16 +409,16 @@ jobs:
393409
if (( ${#failed[@]} )); then
394410
# Join the failed job names with commas
395411
failed_jobs=$(IFS=", "; echo "${failed[*]}")
396-
echo "Failed jobs ----- : $failed_jobs"
412+
echo "❌ Failed jobs ----- : $failed_jobs"
397413
exit 1
398414
fi
399415
400-
echo "All required jobs succeeded"
416+
echo "✅ All required jobs succeeded"
401417
test-controller-distros:
402418
if: github.event.pull_request.draft == false
403419
needs:
404420
- goreleaser
405-
runs-on: warp-ubuntu-latest-x64-2x
421+
runs-on: ${{ vars.DEFAULT_RUNNER }}
406422
outputs:
407423
deb: ${{ steps.params.outputs.deb }}
408424
rpm: ${{ steps.params.outputs.rpm }}
@@ -415,7 +431,6 @@ jobs:
415431
BASE_REF: ${{startsWith(github.event_name, 'pull_request') && github.base_ref || github.ref_name}}
416432
run: |
417433
set -eo pipefail
418-
# WARNING: curl piped to shell - consider downloading and verifying before executing
419434
curl -s --retry 5 --retry-delay 10 --fail-with-body "http://tui.internal.dev.tyk.technology/v2/$VARIATION/tyk-pump/$BASE_REF/${{ github.event_name}}/api/Distros.gho" | tee -a "$GITHUB_OUTPUT"
420435
if ! [[ $VARIATION =~ prod ]];then
421436
echo "::warning file=.github/workflows/release.yml,line=24,col=1,endColumn=8::Using test variation"
@@ -424,7 +439,7 @@ jobs:
424439
services:
425440
httpbin.org:
426441
image: kennethreitz/httpbin
427-
runs-on: warp-ubuntu-latest-x64-2x
442+
runs-on: ${{ vars.DEFAULT_RUNNER }}
428443
needs:
429444
- test-controller-distros
430445
strategy:
@@ -450,7 +465,8 @@ jobs:
450465
ARG TARGETARCH
451466
COPY tyk-pump*_${TARGETARCH}.deb /tyk-pump.deb
452467
RUN apt-get update && apt-get install -y curl
453-
RUN curl -fsSL https://packagecloud.io/install/repositories/tyk/tyk-pump/script.deb.sh | bash || echo "Repository setup failed, but continuing" # WARNING: curl piped to shell - pinning not possible for packagecloud install script
468+
# TODO(security): curl|bash - consider fetching script and verifying checksum before execution
469+
RUN curl -fsSL https://packagecloud.io/install/repositories/tyk/tyk-pump/script.deb.sh | bash || echo "Repository setup failed, but continuing" # SECURITY: accepted risk, see TODO above
454470
RUN apt-get install -y tyk-pump=1.6.0 || echo "Previous version not found, testing fresh install"
455471
RUN dpkg -i /tyk-pump.deb
456472
@@ -470,7 +486,7 @@ jobs:
470486
services:
471487
httpbin.org:
472488
image: kennethreitz/httpbin
473-
runs-on: warp-ubuntu-latest-x64-2x
489+
runs-on: ${{ vars.DEFAULT_RUNNER }}
474490
needs:
475491
- test-controller-distros
476492
strategy:
@@ -497,7 +513,8 @@ jobs:
497513
COPY tyk-pump*.${RHELARCH}.rpm /tyk-pump.rpm
498514
RUN command -v curl || yum install -y curl
499515
RUN command -v useradd || yum install -y shadow-utils
500-
RUN curl -fsSL https://packagecloud.io/install/repositories/tyk/tyk-pump/script.rpm.sh | bash || echo "Repository setup failed, but continuing" # WARNING: curl piped to shell - pinning not possible for packagecloud install script
516+
# TODO(security): curl|bash - consider fetching script and verifying checksum before execution
517+
RUN curl -fsSL https://packagecloud.io/install/repositories/tyk/tyk-pump/script.rpm.sh | bash || echo "Repository setup failed, but continuing" # SECURITY: accepted risk, see TODO above
501518
RUN yum install -y tyk-pump-1.6.0-1 || echo "Previous version not found, testing fresh install"
502519
RUN curl https://keyserver.tyk.io/tyk.io.rpm.signing.key.2020 -o tyk-pump.key && rpm --import tyk-pump.key
503520
RUN rpm --checksig /tyk-pump.rpm
@@ -514,4 +531,4 @@ jobs:
514531
cache-from: type=gha
515532
cache-to: type=gha,mode=max
516533
file: Dockerfile
517-
push: false
534+
push: false

‎ci/Dockerfile.distroless‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,7 @@
11
# Generated by: gromit policy
22

3+
ARG BASE_IMAGE=gcr.io/distroless/static-debian13:nonroot
4+
35
FROM debian:trixie-slim AS deb
46
ARG TARGETARCH
57
ARG BUILD_PACKAGE_NAME
@@ -10,7 +12,7 @@ ENV DEBIAN_FRONTEND=noninteractive
1012
COPY ${BUILD_PACKAGE_NAME}_*${TARGETARCH}.deb /
1113
RUN dpkg -i /${BUILD_PACKAGE_NAME}_*${TARGETARCH}.deb && rm /*.deb
1214

13-
FROM gcr.io/distroless/static-debian12:nonroot
15+
FROM ${BASE_IMAGE}
1416

1517
COPY --from=deb /opt/tyk-pump /opt/tyk-pump
1618

‎ci/Dockerfile.std‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
# Generated by: gromit policy
22

3-
FROM debian:trixie-slim@sha256:edc9450a9fe37d30b508808052f8d0564e3ed9eaf565e043c6f5632957f7381e
3+
FROM debian:trixie-slim
44
ARG TARGETARCH
55
ARG BUILD_PACKAGE_NAME
66

‎ci/goreleaser/goreleaser.yml‎

Lines changed: 22 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -8,10 +8,10 @@ version: 2
88
builds:
99
- id: fips-amd64
1010
flags:
11-
- -tags=fips,boringcrypto
11+
- -tags=fips
1212
env:
1313
- NOP=nop # ignore this, it is jsut to avoid a complex conditional in the templates
14-
- GOEXPERIMENT=boringcrypto
14+
- GOFIPS140=v1.0.0
1515
ldflags:
1616
- -X github.com/TykTechnologies/tyk-pump/pumps.Version={{.Version}}
1717
- -X github.com/TykTechnologies/tyk-pump/pumps.Commit={{.FullCommit}}
@@ -24,10 +24,10 @@ builds:
2424
binary: tyk-pump
2525
- id: fips-arm64
2626
flags:
27-
- -tags=fips,boringcrypto
27+
- -tags=fips
2828
env:
2929
- NOP=nop # ignore this, it is jsut to avoid a complex conditional in the templates
30-
- GOEXPERIMENT=boringcrypto
30+
- GOFIPS140=v1.0.0
3131
ldflags:
3232
- -X github.com/TykTechnologies/tyk-pump/pumps.Version={{.Version}}
3333
- -X github.com/TykTechnologies/tyk-pump/pumps.Commit={{.FullCommit}}
@@ -38,6 +38,22 @@ builds:
3838
goarch:
3939
- arm64
4040
binary: tyk-pump
41+
- id: fips-s390x
42+
flags:
43+
- -tags=fips
44+
env:
45+
- NOP=nop # ignore this, it is jsut to avoid a complex conditional in the templates
46+
- GOFIPS140=v1.0.0
47+
ldflags:
48+
- -X github.com/TykTechnologies/tyk-pump/pumps.Version={{.Version}}
49+
- -X github.com/TykTechnologies/tyk-pump/pumps.Commit={{.FullCommit}}
50+
- -X github.com/TykTechnologies/tyk-pump/pumps.BuildDate={{.Date}}
51+
- -X github.com/TykTechnologies/tyk-pump/pumps.BuiltBy=goreleaser
52+
goos:
53+
- linux
54+
goarch:
55+
- s390x
56+
binary: tyk-pump
4157
- id: std-amd64
4258
env:
4359
- NOP=nop # ignore this, it is jsut to avoid a complex conditional in the templates
@@ -82,12 +98,13 @@ nfpms:
8298
vendor: "Tyk Technologies Ltd"
8399
homepage: "https://tyk.io"
84100
maintainer: "Tyk <info@tyk.io>"
85-
description: Tyk Analytics Pump to move analytics data from Redis to any supported back end (multiple back ends can be written to at once). This version is compiled with boringssl.
101+
description: Tyk Analytics Pump to move analytics data from Redis to any supported back end (multiple back ends can be written to at once). Built with FIPS 140-3 compliant cryptography.
86102
package_name: tyk-pump-fips
87103
file_name_template: "{{ .ConventionalFileName }}"
88104
ids:
89105
- fips-amd64
90106
- fips-arm64
107+
- fips-s390x
91108
formats:
92109
- deb
93110
- rpm

0 commit comments

Comments
 (0)