[fips140][configurablehttpprovider.TestFunctionalityDownloadFileHTTPS] Skip test if GODEBUG=fips140=only is set

[ycombinator]

Description

When #13926 is merged, all unit tests in this repository will be run with GODEBUG=fips140=only to help surface any FIPS-140 violations in all the Go modules in this repository.

One such unit test that fails in these circumstances is confmap/provider/internal/configurablehttpprovider.TestFunctionalityDownloadFileHTTPS. However, the FIPS violation surfaced by this test is from the test code itself (as opposed to from OpenTelemetry Collector core code that the test is exercising), specifically when this call is made:

opentelemetry-collector/confmap/provider/internal/configurablehttpprovider/provider_test.go

Line 81 in 0f3b0c9

derBytes, err := x509.CreateCertificate(rand.Reader, &template, &template, &priv.PublicKey, priv)

As such, this is not a FIPS violation we need to worry about when running the OpenTelemetry Collector. To prevent the unit test from failing when it's run with GODEBUG=fips140=only, we skip it.

Link to tracking issue

Fixes #13998

Testing

Run the configurablehttpprovider.TestFunctionalityDownloadFileHTTPS unit test with GODEBUG=fips140=only.

$ cd confmap/
$ GODEBUG=fips140=only go test ./provider/internal/configurablehttpprovider/... -test.v -test.run TestFunctionalityDownloadFileHTTPS -count 1

[codecov]

Codecov Report

❌ Patch coverage is 50.00000% with 2 lines in your changes missing coverage. Please review.
✅ Project coverage is 92.50%. Comparing base (0f3b0c9) to head (51635fc).
⚠️ Report is 1 commits behind head on main.

Files with missing lines	Patch %	Lines
confmap/provider/testutils/fips.go	50.00%	1 Missing and 1 partial ⚠️

❌ Your patch check has failed because the patch coverage (50.00%) is below the target coverage (95.00%). You can increase the patch coverage or adjust the target coverage.

Additional details and impacted files

@@           Coverage Diff           @@
##             main   #14076   +/-   ##
=======================================
  Coverage   92.50%   92.50%           
=======================================
  Files         660      661    +1     
  Lines       36196    36200    +4     
=======================================
+ Hits        33483    33488    +5     
+ Misses       1892     1891    -1     
  Partials      821      821           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[mx-psi]

For my own education: is the GOFIPS140 env variable only used for deciding the version but not for enabling/disabling then?

[ycombinator]

My understanding is that the GOFIPS140 environment variable is used to select the version of the Go Cryptographic Module to use but, as of now, none of these versions are validated as being FIPS-compliant (mentioned further down in the same doc). So, IMO, there is no benefit to setting this variable, again, as of now.

[mx-psi]

Can you move the test util to confmap/provider/internal? That way we avoid creating more public API. Another alternative is to create a module for testing utils

[ycombinator]

Can you move the test util to confmap/provider/internal? That way we avoid creating more public API. Another alternative is to create a module for testing utils

Thanks for the suggestion, @mx-psi. I decided to make a new module for testing utilities; see 87349a7.

However, now CI is failing on this PR like so:

go: finding module for package go.opentelemetry.io/collector/testutils
go: downloading go.opentelemetry.io v0.1.0
go: go.opentelemetry.io/collector/cmd/otelcorecol imports
	go.opentelemetry.io/collector/confmap/provider/httpprovider imports
	go.opentelemetry.io/collector/confmap/provider/internal/configurablehttpprovider tested by
	go.opentelemetry.io/collector/confmap/provider/internal/configurablehttpprovider.test imports
	go.opentelemetry.io/collector/testutils: module go.opentelemetry.io/collector@latest found (v0.138.0, replaced by ../../), but does not contain package go.opentelemetry.io/collector/testutils
make[2]: *** [../../Makefile.Common:67: tidy] Error 1
make[2]: Leaving directory '/home/runner/work/opentelemetry-collector/opentelemetry-collector/cmd/otelcorecol'
make[1]: *** [Makefile:148: cmd/otelcorecol] Error 2
make[1]: Leaving directory '/home/runner/work/opentelemetry-collector/opentelemetry-collector'
make: *** [Makefile:95: gotidy] Error 2
Error: Process completed with exit code 2.

I'm guessing I need to make a separate PR first that introduces the go.opentelemetry.io/collector/testutils module?

[dmathieu]

This shouldn't be a public module. If we expect there will be more tests skipped on FIPS, it makes sense to have this as a module global to the collector. But it should be under internal/.

[ycombinator]

@dmathieu Thanks for the suggestion and discussion (off-PR). Please take a look at d572257 and 3aba4a9. Is this in line with what you were suggesting?

[dmathieu]

It is. I think to fix the linter, you need to run make gotidy.

[ycombinator]

It is. I think to fix the linter, you need to run make gotidy.

Thanks. I ran make gotidy and am getting this error:

go: go.opentelemetry.io/collector/cmd/otelcorecol imports
	go.opentelemetry.io/collector/exporter/otlpexporter tested by
	go.opentelemetry.io/collector/exporter/otlpexporter.test imports
	go.opentelemetry.io/collector/internal/testutil: module go.opentelemetry.io/collector@latest found (v0.138.0, replaced by ../../), but does not contain package go.opentelemetry.io/collector/internal/testutil
make[2]: *** [tidy] Error 1
make[1]: *** [cmd/otelcorecol] Error 2
make: *** [gotidy] Error 2

Do you think I need to publish the go.opentelemetry.io/collector/internal/testutil module first via a separate PR?

[dmathieu]

You need a replace statement so the testutil package properly points to the local path, not to a released package.

diff --git a/confmap/go.mod b/confmap/go.mod
index 35d3f3f81..426bbf6ba 100644
--- a/confmap/go.mod
+++ b/confmap/go.mod
@@ -10,6 +10,7 @@ require (
        github.com/knadh/koanf/v2 v2.3.0
        github.com/stretchr/testify v1.11.1
        go.opentelemetry.io/collector/featuregate v1.44.0
+       go.opentelemetry.io/collector/internal/testutil v0.0.0-00010101000000-000000000000
        go.uber.org/goleak v1.3.0
        go.uber.org/multierr v1.11.0
        go.uber.org/zap v1.27.0
@@ -30,4 +31,6 @@ retract (
        v0.69.0 // Release failed, use v0.69.1
 )

+replace go.opentelemetry.io/collector/internal/testutil => ../internal/testutil
+