feat(fips): add fips compliant packages (#177)

* feat(fips): add fips compliant packages

* udpate dependence on fips agent

.github/workflows/on_prerelease.yaml

@@ -12,4 +12,5 @@ jobs:
     with:
       tag: ${{ github.event.release.tag_name }}
       integration: rabbitmq
+      upload_fips_packages: true
     secrets: inherit

.github/workflows/on_release.yaml

@@ -13,4 +13,5 @@ jobs:
     with:
       integration: rabbitmq
       tag: ${{ github.event.release.tag_name }}
+      upload_fips_packages: true
     secrets: inherit

CHANGELOG.md

@@ -8,6 +8,9 @@ and this project adheres to [Semantic Versioning](http://semver.org/).
 Unreleased section should follow [Release Toolkit](https://github.com/newrelic/release-toolkit#render-markdown-and-update-markdown)
 ## Unreleased
 
+### enhancements
+- Add FIPS compliant packages
+
 ## v2.14.2 - 2025-01-29
 
 ### ⛓️ Dependencies

Makefile

@@ -1,7 +1,9 @@
-INTEGRATION  := rabbitmq
-GO_FILES        := ./src/
-BINARY_NAME   = nri-$(INTEGRATION)
-GOFLAGS		  = -mod=readonly
+INTEGRATION  	:= rabbitmq
+GO_FILES       	:= ./src/
+BINARY_NAME   	= nri-$(INTEGRATION)
+GOFLAGS		  	= -mod=readonly
+GO_VERSION 		?= $(shell grep '^go ' go.mod | awk '{print $$2}')
+BUILDER_IMAGE 	?= "ghcr.io/newrelic/coreint-automation:latest-go$(GO_VERSION)-ubuntu16.04"
 
 all: build
 

build/.goreleaser.yml

@@ -1,3 +1,6 @@
+---
+version: 2
+project_name: nri-rabbitmq
 builds:
   - id: nri-nix
     main: ./src
@@ -17,6 +20,26 @@ builds:
     ignore:
       - goos: darwin
         goarch: 386
+
+  - id: nri-nix-fips
+    main: ./src
+    binary: nri-rabbitmq
+    ldflags:
+      - -s -w -X main.integrationVersion={{.Version}} -X main.gitCommit={{.Commit}} -X main.buildDate={{.Date}}
+    env:
+      - CGO_ENABLED=1
+      - GOEXPERIMENT=boringcrypto
+      - >-
+        {{- if eq .Arch "arm64" -}}
+        CC=aarch64-linux-gnu-gcc
+        {{- end }}
+    goos:
+      - linux
+    goarch:
+      - amd64
+      - arm64
+    tags:
+      - fips
 
   - id: nri-win
     main: ./src
@@ -36,7 +59,8 @@ builds:
 
 nfpms:
   - id: linux
-    file_name_template: "{{ .ProjectName }}_{{ .Version }}-1_{{ .Arch }}"
+    package_name: nri-rabbitmq
+    file_name_template: "{{ .PackageName }}_{{ .Version }}-1_{{ .Arch }}"
     vendor: "New Relic, Inc."
     homepage: "https://www.newrelic.com/infrastructure"
     maintainer: "New Relic Infrastructure Team <[email protected]>"
@@ -67,9 +91,59 @@ nfpms:
 
     overrides:
       rpm:
-        file_name_template: "{{ .ProjectName }}-{{ .Version }}-1.{{ .Arch }}"
-        replacements:
-          amd64: x86_64
+        file_name_template: >-
+          {{- .ProjectName }}-
+          {{- .Version }}-1.
+          {{- if eq .Arch "amd64" -}}x86_64
+          {{- else -}}
+          {{ .Arch }}
+          {{- end }}
+
+    # Formats to be generated.
+    formats:
+      - deb
+      - rpm
+
+  - id: linux-fips
+    package_name: nri-rabbitmq-fips
+    file_name_template: "{{ .PackageName }}_{{ .Version }}-1_{{ .Arch }}"
+    vendor: "New Relic, Inc."
+    homepage: "https://www.newrelic.com/infrastructure"
+    maintainer: "New Relic Infrastructure Team <[email protected]>"
+    description: "New Relic Infrastructure rabbitmq Integration extend the core New Relic\nInfrastructure agent's capabilities to allow you to collect metric and\nlive state data from rabbitmq components."
+    license: "https://newrelic.com/terms (also see LICENSE installed with this package)"
+
+    builds:
+      - nri-nix-fips
+
+    dependencies:
+      - newrelic-infra-fips (>= 1.60.0)
+
+    bindir: "/var/db/newrelic-infra/newrelic-integrations/bin"
+    contents:
+      - src: "rabbitmq-config.yml.sample"
+        dst: "/etc/newrelic-infra/integrations.d/rabbitmq-config.yml.sample"
+      - src: "rabbitmq-log.yml.example"
+        dst: "/etc/newrelic-infra/logging.d/rabbitmq-log.yml.example"
+      - src: "CHANGELOG.md"
+        dst: "/usr/share/doc/nri-rabbitmq/CHANGELOG.md"
+      - src: "README.md"
+        dst: "/usr/share/doc/nri-rabbitmq/README.md"
+      - src: "LICENSE"
+        dst: "/usr/share/doc/nri-rabbitmq/LICENSE"
+      - src: "legacy/rabbitmq-definition.yml"
+        dst: "/var/db/newrelic-infra/newrelic-integrations/rabbitmq-definition.yml"
+        type: config
+
+    overrides:
+      rpm:
+        file_name_template: >-
+          {{- .ProjectName }}-fips-
+          {{- .Version }}-1.
+          {{- if eq .Arch "amd64" -}}x86_64
+          {{- else -}}
+          {{ .Arch }}
+          {{- end }}
 
     # Formats to be generated.
     formats:
@@ -88,6 +162,18 @@ archives:
         dst: .
         strip_parent: true
     format: tar.gz
+
+  - id: nri-nix-fips
+    builds:
+      - nri-nix-fips
+    name_template: "{{ .ProjectName }}-fips_{{ .Os }}_{{ .Version }}_{{ .Arch }}_dirty"
+    files:
+      - rabbitmq-config.yml.sample
+      - rabbitmq-log.yml.example
+      - src: 'legacy/rabbitmq-definition.yml'
+        dst: .
+        strip_parent: true
+    format: tar.gz
 
   - id: nri-win
     builds:

build/ci.mk

@@ -1,8 +1,9 @@
-BUILDER_TAG ?= nri-$(INTEGRATION)-builder
+.PHONY : ci/pull-builder-image
+ci/pull-builder-image:
+	@docker pull $(BUILDER_IMAGE)
 
 .PHONY : ci/deps
-ci/deps:
-	@docker build -t $(BUILDER_TAG) -f $(CURDIR)/build/Dockerfile $(CURDIR)
+ci/deps: ci/pull-builder-image
 
 .PHONY : ci/debug-container
 ci/debug-container: ci/deps
@@ -17,15 +18,15 @@ ci/debug-container: ci/deps
 			-e GPG_MAIL \
 			-e GPG_PASSPHRASE \
 			-e GPG_PRIVATE_KEY_BASE64 \
-			$(BUILDER_TAG) bash
+			$(BUILDER_IMAGE) bash
 
 .PHONY : ci/test
 ci/test: ci/deps
 	@docker run --rm -t \
 			--name "nri-$(INTEGRATION)-test" \
 			-v $(CURDIR):/go/src/github.com/newrelic/nri-$(INTEGRATION) \
 			-w /go/src/github.com/newrelic/nri-$(INTEGRATION) \
-			$(BUILDER_TAG) make test
+			$(BUILDER_IMAGE) make test
 
 .PHONY : ci/build
 ci/build: ci/deps
@@ -36,7 +37,7 @@ ifdef TAG
 			-w /go/src/github.com/newrelic/nri-$(INTEGRATION) \
 			-e INTEGRATION \
 			-e TAG \
-			$(BUILDER_TAG) make release/build
+			$(BUILDER_IMAGE) make release/build
 else
 	@echo "===> $(INTEGRATION) ===  [ci/build] TAG env variable expected to be set"
 	exit 1
@@ -57,7 +58,7 @@ ifdef TAG
 			-e GPG_MAIL \
 			-e GPG_PASSPHRASE \
 			-e GPG_PRIVATE_KEY_BASE64 \
-			$(BUILDER_TAG) make release
+			$(BUILDER_IMAGE) make release
 else
 	@echo "===> $(INTEGRATION) ===  [ci/prerelease] TAG env variable expected to be set"
 	exit 1
@@ -80,7 +81,7 @@ ifdef TAG
 			-e GPG_MAIL \
 			-e GPG_PASSPHRASE \
 			-e GPG_PRIVATE_KEY_BASE64 \
-			$(BUILDER_TAG) make release
+			$(BUILDER_IMAGE) make release
 else
 	@echo "===> $(INTEGRATION) ===  [ci/fake-prerelease] TAG env variable expected to be set"
 	exit 1

build/release.mk

@@ -1,5 +1,5 @@
 BUILD_DIR    := ./bin/
-GORELEASER_VERSION := v0.174.1
+GORELEASER_VERSION := v2.4.4
 GORELEASER_BIN ?= bin/goreleaser
 
 bin:
@@ -27,10 +27,10 @@ release/deps: $(GORELEASER_BIN)
 release/build: release/deps release/clean
 ifeq ($(PRERELEASE), true)
 	@echo "===> $(INTEGRATION) === [release/build] PRE-RELEASE compiling all binaries, creating packages, archives"
-	@$(GORELEASER_BIN) release --config $(CURDIR)/build/.goreleaser.yml --rm-dist
+	@$(GORELEASER_BIN) release --config $(CURDIR)/build/.goreleaser.yml --clean
 else
 	@echo "===> $(INTEGRATION) === [release/build] build compiling all binaries"
-	@$(GORELEASER_BIN) build --config $(CURDIR)/build/.goreleaser.yml --snapshot --rm-dist
+	@$(GORELEASER_BIN) build --config $(CURDIR)/build/.goreleaser.yml --snapshot --clean
 endif
 
 .PHONY : release/fix-archive
@@ -44,7 +44,7 @@ release/fix-archive:
 ifneq ($(NO_SIGN), true)
 release/sign/nix:
 	@echo "===> $(INTEGRATION) === [release/sign] signing packages"
-	@bash $(CURDIR)/build/nix/sign.sh
+	@bash sign.sh
 else
 	@echo "===> $(INTEGRATION) === [release/sign] signing packages is disabled by environment variable"
 endif

src/fips.go

@@ -0,0 +1,11 @@
+// Copyright 2025 New Relic Corporation. All rights reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+//go:build fips
+// +build fips
+
+package main
+
+import (
+	_ "crypto/tls/fipsonly"
+)