feat(fips): add fips compliant packages (#217)

feat(fips): add fips compliant packages

Author: sairaj18

.github/workflows/on_prerelease.yaml

@@ -13,4 +13,5 @@ jobs:
     with:
       tag: ${{ github.event.release.tag_name }}
       integration: "vsphere"
+      upload_fips_packages: true
     secrets: inherit

.github/workflows/on_release.yaml

@@ -13,4 +13,5 @@ jobs:
     with:
       integration: vsphere
       tag: ${{ github.event.release.tag_name }}
+      upload_fips_packages: true
     secrets: inherit

CHANGELOG.md

@@ -8,6 +8,9 @@ Unreleased section should follow [Release Toolkit](https://github.com/newrelic/r
 
 ## Unreleased
 
+### enhancements
+- Add FIPS compliant packages
+
 ## v1.6.3 - 2025-02-20
 
 ### ⛓️ Dependencies

Makefile

@@ -4,6 +4,8 @@ NATIVEOS     := $(shell $(GO_CMD) version | awk -F '[ /]' '{print $$4}')
 NATIVEARCH   := $(shell $(GO_CMD) version | awk -F '[ /]' '{print $$5}')
 GO_PKGS      := $(shell $(GO_CMD) list ./... | grep -v -e "/vendor/" -e "/example")
 GO_FILES     := $(shell find cmd -type f -name "*.go")
+GO_VERSION 		?= $(shell grep '^go ' go.mod | awk '{print $$2}')
+BUILDER_IMAGE 	?= "ghcr.io/newrelic/coreint-automation:latest-go$(GO_VERSION)-ubuntu16.04"
 
 BIN_DIR            = $(WORKDIR)/bin
 TARGET             = target

build/.goreleaser.yml

@@ -1,3 +1,6 @@
+---
+version: 2
+project_name: nri-vsphere
 builds:
   - id: nri-vsphere-nix
     main: ./cmd/nri-vsphere
@@ -18,6 +21,26 @@ builds:
       - goos: darwin
         goarch: 386
 
+  - id: nri-vsphere-nix-fips
+    main: ./cmd/nri-vsphere
+    binary: nri-vsphere
+    ldflags:
+      - -s -w -X main.integrationVersion={{.Version}} -X main.gitCommit={{.Commit}} -X main.buildDate={{.Date}}
+    env:
+      - CGO_ENABLED=1
+      - GOEXPERIMENT=boringcrypto
+      - >-
+        {{- if eq .Arch "arm64" -}}
+        CC=aarch64-linux-gnu-gcc
+        {{- end }}
+    goos:
+      - linux
+    goarch:
+      - amd64
+      - arm64
+    tags:
+      - fips
+
   - id: nri-vsphere-win
     main: ./cmd/nri-vsphere
     binary: nri-vsphere
@@ -35,13 +58,17 @@ builds:
 
 nfpms:
   - id: linux
-    file_name_template: "{{ .ProjectName }}_{{ .Version }}-1_{{ .Arch }}"
+    package_name: nri-vsphere
+    file_name_template: "{{ .PackageName }}_{{ .Version }}-1_{{ .Arch }}"
     vendor: "New Relic, Inc."
     homepage: "https://www.newrelic.com/infrastructure"
     maintainer: "New Relic Infrastructure Team <[email protected]>"
     description: "New Relic Infrastructure vsphere Integration extend the core New Relic\nInfrastructure agent's capabilities to allow you to collect metric and\nlive state data from vsphere components."
     license: "https://newrelic.com/terms (also see LICENSE installed with this package)"
 
+    builds:
+      - nri-vsphere-nix
+
     dependencies:
       - "newrelic-infra"
 
@@ -63,9 +90,58 @@ nfpms:
 
     overrides:
       rpm:
-        file_name_template: "{{ .ProjectName }}-{{ .Version }}-1.{{ .Arch }}"
-        replacements:
-          amd64: x86_64
+        file_name_template: >-
+          {{- .ProjectName }}-
+          {{- .Version }}-1.
+          {{- if eq .Arch "amd64" -}}x86_64
+          {{- else -}}
+          {{ .Arch }}
+          {{- end }}
+
+    formats:
+      - deb
+      - rpm
+  
+  - id: linux-fips
+    package_name: nri-vsphere-fips
+    file_name_template: "{{ .PackageName }}_{{ .Version }}-1_{{ .Arch }}"
+    vendor: "New Relic, Inc."
+    homepage: "https://www.newrelic.com/infrastructure"
+    maintainer: "New Relic Infrastructure Team <[email protected]>"
+    description: "New Relic Infrastructure vsphere Integration extend the core New Relic\nInfrastructure agent's capabilities to allow you to collect metric and\nlive state data from vsphere components."
+    license: "https://newrelic.com/terms (also see LICENSE installed with this package)"
+
+    builds:
+      - nri-vsphere-nix-fips
+
+    dependencies:
+      - newrelic-infra-fips (>= 1.60.0)
+
+    bindir: "/var/db/newrelic-infra/newrelic-integrations/bin"
+
+    contents:
+      - src: "vsphere-config.yml.sample"
+        dst: "/etc/newrelic-infra/integrations.d/vsphere-config.yml.sample"
+        type: config
+      - src: "vsphere-performance.metrics"
+        dst: "/etc/newrelic-infra/integrations.d/vsphere-performance.metrics"
+        type: config
+      - src: "CHANGELOG.md"
+        dst: "/usr/share/doc/nri-vsphere/CHANGELOG.md"
+      - src: "README.md"
+        dst: "/usr/share/doc/nri-vsphere/README.md"
+      - src: "LICENSE"
+        dst: "/usr/share/doc/nri-vsphere/LICENSE"
+
+    overrides:
+      rpm:
+        file_name_template: >-
+          {{- .ProjectName }}-fips-
+          {{- .Version }}-1.
+          {{- if eq .Arch "amd64" -}}x86_64
+          {{- else -}}
+          {{ .Arch }}
+          {{- end }}
 
     formats:
       - deb
@@ -80,6 +156,15 @@ archives:
       - vsphere-config.yml.sample
       - vsphere-performance.metrics
     format: tar.gz
+  
+  - id: nri-vsphere-nix-fips
+    builds:
+      - nri-vsphere-nix-fips
+    name_template: "{{ .ProjectName }}-fips_{{ .Os }}_{{ .Version }}_{{ .Arch }}_dirty"
+    files:
+      - vsphere-config.yml.sample
+      - vsphere-performance.metrics
+    format: tar.gz
 
   - id: nri-vsphere-win
     builds:

build/Dockerfile

@@ -1,8 +1,9 @@
-BUILDER_TAG ?= nri-$(INTEGRATION)-builder
+.PHONY : ci/pull-builder-image
+ci/pull-builder-image:
+	@docker pull $(BUILDER_IMAGE)
 
 .PHONY : ci/deps
-ci/deps:
-	@docker build -t $(BUILDER_TAG) -f $(CURDIR)/build/Dockerfile $(CURDIR)
+ci/deps: ci/pull-builder-image
 
 .PHONY : ci/debug-container
 ci/debug-container: ci/deps
@@ -17,7 +18,7 @@ ci/debug-container: ci/deps
 			-e GPG_MAIL \
 			-e GPG_PASSPHRASE \
 			-e GPG_PRIVATE_KEY_BASE64 \
-			$(BUILDER_TAG) bash
+			$(BUILDER_IMAGE) bash
 
 
 .PHONY : ci/test
@@ -26,7 +27,7 @@ ci/test: ci/deps
 			--name "nri-$(INTEGRATION)-test" \
 			-v $(CURDIR):/go/src/github.com/newrelic/nri-$(INTEGRATION) \
 			-w /go/src/github.com/newrelic/nri-$(INTEGRATION) \
-			$(BUILDER_TAG) make test
+			$(BUILDER_IMAGE) make test
 
 
 .PHONY : ci/build
@@ -38,7 +39,7 @@ ifdef TAG
 			-w /go/src/github.com/newrelic/nri-$(INTEGRATION) \
 			-e INTEGRATION \
 			-e TAG \
-			$(BUILDER_TAG) make release/build
+			$(BUILDER_IMAGE) make release/build
 else
 	@echo "===> $(INTEGRATION) ===  [ci/build] TAG env variable expected to be set"
 	exit 1
@@ -59,7 +60,7 @@ ifdef TAG
 			-e GPG_MAIL \
 			-e GPG_PASSPHRASE \
 			-e GPG_PRIVATE_KEY_BASE64 \
-			$(BUILDER_TAG) make release
+			$(BUILDER_IMAGE) make release
 else
 	@echo "===> $(INTEGRATION) ===  [ci/prerelease] TAG env variable expected to be set"
 	exit 1
@@ -82,7 +83,7 @@ ifdef TAG
 			-e GPG_MAIL \
 			-e GPG_PASSPHRASE \
 			-e GPG_PRIVATE_KEY_BASE64 \
-			$(BUILDER_TAG) make release
+			$(BUILDER_IMAGE) make release
 else
 	@echo "===> $(INTEGRATION) ===  [ci/fake-prerelease] TAG env variable expected to be set"
 	exit 1

build/ci.mk

@@ -1,5 +1,5 @@
 BUILD_DIR    := ./bin/
-GORELEASER_VERSION := v0.154.0
+GORELEASER_VERSION := v2.4.4
 GORELEASER_BIN ?= bin/goreleaser
 
 bin:
@@ -27,10 +27,10 @@ release/deps: $(GORELEASER_BIN)
 release/build: release/deps release/clean
 ifeq ($(PRERELEASE), true)
 	@echo "===> $(INTEGRATION) === [release/build] PRE-RELEASE compiling all binaries, creating packages, archives"
-	@$(GORELEASER_BIN) release --config $(CURDIR)/build/.goreleaser.yml --rm-dist
+	@$(GORELEASER_BIN) release --config $(CURDIR)/build/.goreleaser.yml --clean
 else
 	@echo "===> $(INTEGRATION) === [release/build] build compiling all binaries"
-	@$(GORELEASER_BIN) build --config $(CURDIR)/build/.goreleaser.yml --snapshot --rm-dist
+	@$(GORELEASER_BIN) build --config $(CURDIR)/build/.goreleaser.yml --snapshot --clean
 endif
 
 .PHONY : release/fix-archive
@@ -44,7 +44,7 @@ release/fix-archive:
 release/sign/nix:
 ifneq ($(NO_SIGN), true)
 	@echo "===> $(INTEGRATION) === [release/sign] signing packages"
-	@bash $(CURDIR)/build/nix/sign.sh
+	@bash sign.sh
 else
 	@echo "===> $(INTEGRATION) === [release/sign] signing packages is disabled by environment variable"
 endif

build/nix/sign.sh

@@ -0,0 +1,11 @@
+// Copyright 2025 New Relic Corporation. All rights reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+//go:build fips
+// +build fips
+
+package main
+
+import (
+	_ "crypto/tls/fipsonly"
+)