feat(fips): add fips compliant packages (#175)

* feat(fips): add fips compliant packages

* update dependence on fips agent

.github/workflows/on_prerelease.yaml

@@ -12,4 +12,5 @@ jobs:
     with:
       tag: ${{ github.event.release.tag_name }}
       integration: mysql
+      upload_fips_packages: true
     secrets: inherit

.github/workflows/on_release.yaml

@@ -13,4 +13,5 @@ jobs:
     with:
       integration: mysql
       tag: ${{ github.event.release.tag_name }}
+      upload_fips_packages: true
     secrets: inherit

CHANGELOG.md

@@ -9,6 +9,9 @@ Unreleased section should follow [Release Toolkit](https://github.com/newrelic/r
 
 ## Unreleased
 
+### enhancements
+- Add FIPS compliant packages
+
 ## v1.12.0 - 2025-01-20
 
 ### 🚀 Enhancements

Makefile

@@ -6,6 +6,8 @@ CONFIG_DIR       = /etc/newrelic-infra/integrations.d
 GO_FILES        := ./src/
 GOFLAGS          = -mod=readonly
 GOLANGCI_LINT    = github.com/golangci/golangci-lint/cmd/golangci-lint
+GO_VERSION 			?= $(shell grep '^go ' go.mod | awk '{print $$2}')
+BUILDER_IMAGE 		?= "ghcr.io/newrelic/coreint-automation:latest-go$(GO_VERSION)-ubuntu16.04"
 
 all: build
 

build/.goreleaser.yml

@@ -1,3 +1,6 @@
+---
+version: 2
+project_name: nri-mysql
 builds:
   - id: nri-mysql-nix
     main: ./src
@@ -17,6 +20,26 @@ builds:
     ignore:
       - goos: darwin
         goarch: 386
+
+  - id: nri-mysql-nix-fips
+    main: ./src
+    binary: nri-mysql
+    ldflags:
+      - -s -w -X main.integrationVersion={{.Version}} -X main.gitCommit={{.Commit}} -X main.buildDate={{.Date}}
+    env:
+      - CGO_ENABLED=1
+      - GOEXPERIMENT=boringcrypto
+      - >-
+        {{- if eq .Arch "arm64" -}}
+        CC=aarch64-linux-gnu-gcc
+        {{- end }}
+    goos:
+      - linux
+    goarch:
+      - amd64
+      - arm64
+    tags:
+      - fips
 
   - id: nri-mysql-win
     main: ./src
@@ -35,7 +58,8 @@ builds:
 
 nfpms:
   - id: linux
-    file_name_template: "{{ .ProjectName }}_{{ .Version }}-1_{{ .Arch }}"
+    package_name: nri-mysql
+    file_name_template: "{{ .PackageName }}_{{ .Version }}-1_{{ .Arch }}"
     vendor: "New Relic, Inc."
     homepage: "https://www.newrelic.com/infrastructure"
     maintainer: "New Relic Infrastructure Team <[email protected]>"
@@ -67,9 +91,59 @@ nfpms:
 
     overrides:
       rpm:
-        file_name_template: "{{ .ProjectName }}-{{ .Version }}-1.{{ .Arch }}"
-        replacements:
-          amd64: x86_64
+        file_name_template: >-
+          {{- .ProjectName }}-
+          {{- .Version }}-1.
+          {{- if eq .Arch "amd64" -}}x86_64
+          {{- else -}}
+          {{ .Arch }}
+          {{- end }}
+
+    formats:
+      - deb
+      - rpm
+
+  - id: linux-fips
+    package_name: nri-mysql-fips
+    file_name_template: "{{ .PackageName }}_{{ .Version }}-1_{{ .Arch }}"
+    vendor: "New Relic, Inc."
+    homepage: "https://www.newrelic.com/infrastructure"
+    maintainer: "New Relic Infrastructure Team <[email protected]>"
+    description: "New Relic Infrastructure mysql Integration extend the core New Relic\nInfrastructure agent's capabilities to allow you to collect metric and\nlive state data from mysql components."
+    license: "https://newrelic.com/terms (also see LICENSE installed with this package)"
+
+    builds:
+      - nri-mysql-nix-fips
+
+    dependencies:
+      - newrelic-infra-fips (>= 1.60.0)
+
+    bindir: "/var/db/newrelic-infra/newrelic-integrations/bin"
+
+    contents:
+      - src: "mysql-config.yml.sample"
+        dst: "/etc/newrelic-infra/integrations.d/mysql-config.yml.sample"
+      - src: "mysql-log.yml.example"
+        dst: "/etc/newrelic-infra/logging.d/mysql-log.yml.example"
+      - src: "CHANGELOG.md"
+        dst: "/usr/share/doc/nri-mysql/CHANGELOG.md"
+      - src: "README.md"
+        dst: "/usr/share/doc/nri-mysql/README.md"
+      - src: "LICENSE"
+        dst: "/usr/share/doc/nri-mysql/LICENSE"
+      - src: "legacy/mysql-definition.yml"
+        dst: "/var/db/newrelic-infra/newrelic-integrations/mysql-definition.yml"
+        type: config
+
+    overrides:
+      rpm:
+        file_name_template: >-
+          {{- .ProjectName }}-fips-
+          {{- .Version }}-1.
+          {{- if eq .Arch "amd64" -}}x86_64
+          {{- else -}}
+          {{ .Arch }}
+          {{- end }}
 
     formats:
       - deb
@@ -87,6 +161,17 @@ archives:
         strip_parent: true
     format: tar.gz
 
+  - id: nri-mysql-nix-fips
+    builds:
+      - nri-mysql-nix-fips
+    name_template: "{{ .ProjectName }}-fips_{{ .Os }}_{{ .Version }}_{{ .Arch }}_dirty"
+    files:
+      - mysql-config.yml.sample
+      - src: 'legacy/mysql-definition.yml'
+        dst: .
+        strip_parent: true
+    format: tar.gz
+
   - id: nri-mysql-win
     builds:
       - nri-mysql-win

build/ci.mk

@@ -1,8 +1,9 @@
-BUILDER_TAG ?= nri-$(INTEGRATION)-builder
+.PHONY : ci/pull-builder-image
+ci/pull-builder-image:
+	@docker pull $(BUILDER_IMAGE)
 
 .PHONY : ci/deps
-ci/deps:
-	@docker build -t $(BUILDER_TAG) -f $(CURDIR)/build/Dockerfile $(CURDIR)
+ci/deps: ci/pull-builder-image
 
 .PHONY : ci/debug-container
 ci/debug-container: ci/deps
@@ -17,15 +18,15 @@ ci/debug-container: ci/deps
 			-e GPG_MAIL \
 			-e GPG_PASSPHRASE \
 			-e GPG_PRIVATE_KEY_BASE64 \
-			$(BUILDER_TAG) bash
+			$(BUILDER_IMAGE) bash
 
 .PHONY : ci/test
 ci/test: ci/deps
 	@docker run --rm -t \
 			--name "nri-$(INTEGRATION)-test" \
 			-v $(CURDIR):/go/src/github.com/newrelic/nri-$(INTEGRATION) \
 			-w /go/src/github.com/newrelic/nri-$(INTEGRATION) \
-			$(BUILDER_TAG) make test
+			$(BUILDER_IMAGE) make test
 
 .PHONY : ci/snyk-test
 ci/snyk-test:
@@ -46,7 +47,7 @@ ifdef TAG
 			-w /go/src/github.com/newrelic/nri-$(INTEGRATION) \
 			-e INTEGRATION \
 			-e TAG \
-			$(BUILDER_TAG) make release/build
+			$(BUILDER_IMAGE) make release/build
 else
 	@echo "===> $(INTEGRATION) ===  [ci/build] TAG env variable expected to be set"
 	exit 1
@@ -67,7 +68,7 @@ ifdef TAG
 			-e GPG_MAIL \
 			-e GPG_PASSPHRASE \
 			-e GPG_PRIVATE_KEY_BASE64 \
-			$(BUILDER_TAG) make release
+			$(BUILDER_IMAGE) make release
 else
 	@echo "===> $(INTEGRATION) ===  [ci/prerelease] TAG env variable expected to be set"
 	exit 1

build/release.mk

@@ -1,5 +1,5 @@
 BUILD_DIR    := ./bin/
-GORELEASER_VERSION := v0.174.1
+GORELEASER_VERSION := v2.4.4
 GORELEASER_BIN ?= bin/goreleaser
 
 bin:
@@ -27,10 +27,10 @@ release/deps: $(GORELEASER_BIN)
 release/build: release/deps release/clean
 ifeq ($(PRERELEASE), true)
 	@echo "===> $(INTEGRATION) === [release/build] PRE-RELEASE compiling all binaries, creating packages, archives"
-	@$(GORELEASER_BIN) release --config $(CURDIR)/build/.goreleaser.yml --rm-dist
+	@$(GORELEASER_BIN) release --config $(CURDIR)/build/.goreleaser.yml --clean
 else
 	@echo "===> $(INTEGRATION) === [release/build] build compiling all binaries"
-	@$(GORELEASER_BIN) build --config $(CURDIR)/build/.goreleaser.yml --snapshot --rm-dist
+	@$(GORELEASER_BIN) build --config $(CURDIR)/build/.goreleaser.yml --snapshot --clean
 endif
 
 .PHONY : release/fix-archive
@@ -43,7 +43,7 @@ release/fix-archive:
 .PHONY : release/sign/nix
 release/sign/nix:
 	@echo "===> $(INTEGRATION) === [release/sign] signing packages"
-	@bash $(CURDIR)/build/nix/sign.sh
+	@bash sign.sh
 
 
 .PHONY : release/publish

src/fips.go

@@ -0,0 +1,11 @@
+// Copyright 2025 New Relic Corporation. All rights reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+//go:build fips
+// +build fips
+
+package main
+
+import (
+	_ "crypto/tls/fipsonly"
+)