Skip to content

Commit 3cc97a5

Browse files
mudlersmudler
mudlers
and
mudler
authored
Add fips toolchain (#513)
* Add golang-fips Split golang into a collection Signed-off-by: Ettore Di Giacinto <[email protected]> * Move common toolchain packages to a single collection Signed-off-by: Ettore Di Giacinto <[email protected]> Co-authored-by: Ettore Di Giacinto <[email protected]>
1 parent 0d402c1 commit 3cc97a5

File tree

13 files changed

+164
-101
lines changed

13 files changed

+164
-101
lines changed

‎packages/golang/build.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,7 @@ prelude:
1616
{{end}}
1717
- |
1818
PACKAGE_VERSION=${PACKAGE_VERSION%\+*} && \
19-
wget https://golang.org/dl/go$PACKAGE_VERSION.linux-{{.Values.golang_arch}}.tar.gz -O golang.tar.gz
19+
wget {{.Values.base_url}}/go$PACKAGE_VERSION.linux-{{.Values.golang_arch}}.tar.gz -O golang.tar.gz
2020
- echo "{{ ( index .Values.labels "package.checksum" ) }} golang.tar.gz" | sha256sum -c
2121
steps:
2222
- tar -C /usr/local -xzf golang.tar.gz

‎packages/golang/collection.yaml‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
packages:
2+
- name: "golang"
3+
category: "build"
4+
version: 1.16.6+5
5+
base_url: https://golang.org/dl
6+
hidden: true # No need to make it installable for now
7+
labels:
8+
autobump.revdeps: "true"
9+
autobump.string_replace: '{ "prefix": "" }'
10+
autobump.strategy: "custom"
11+
autobump.prefix: "prefix"
12+
autobump.hook: |
13+
curl -s -L 'https://golang.org/VERSION?m=text' | sed 's/go//g'
14+
autobump.version_hook: |
15+
curl -s -L 'https://golang.org/VERSION?m=text' | sed 's/go//g'
16+
package.version: "1.16.6"
17+
autobump.checksum_hook: "curl -q -L https://storage.googleapis.com/golang/go{{.Values.labels.package.version}}.linux-{{.Values.golang_arch}}.tar.gz.sha256"
18+
package.checksum: "be333ef18b3016e9d7cb7b1ff1fdb0cac800ca0be4cf2290fe613b3d069dfe0d"
19+
- name: "golang-fips"
20+
category: "build"
21+
version: "1.16.6b7"
22+
base_url: https://go-boringcrypto.storage.googleapis.com
23+
hidden: true # No need to make it installable for now
24+
labels:
25+
autobump.revdeps: "true"
26+
autobump.string_replace: '{ "prefix": "" }'
27+
autobump.strategy: "custom"
28+
autobump.prefix: "prefix"
29+
autobump.hook: |
30+
curl -s -L https://raw.githubusercontent.com/golang/go/dev.boringcrypto/misc/boring/RELEASES | tail -n1 | cut -d" " -f 1 | sed 's/go//'
31+
autobump.version_hook: |
32+
curl -s -L https://raw.githubusercontent.com/golang/go/dev.boringcrypto/misc/boring/RELEASES | tail -n1 | cut -d" " -f 1 | sed 's/go//'
33+
package.version: "1.16.6b7"
34+
autobump.checksum_hook: |
35+
curl -s -L https://raw.githubusercontent.com/golang/go/dev.boringcrypto/misc/boring/RELEASES | grep go{{.Values.labels.package.version}} | grep -v src | cut -d" " -f 5
36+
package.checksum: "f7f33064643ce0ab8ac1cede100e7eee8509a970178f5be961d9fba331226067"

‎packages/golang/definition.yaml‎

Lines changed: 0 additions & 16 deletions
This file was deleted.

‎packages/meta/collection.yaml‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,34 @@ packages:
2424
- category: toolchain
2525
name: luet
2626
version: ">=0"
27+
- name: "base-dracut-modules"
28+
category: "system"
29+
version: ">=0"
30+
- category: "meta"
31+
name: "cos-minimal-fips"
32+
version: "0.6.1+1"
33+
requires:
34+
- category: toolchain-fips
35+
name: yip
36+
version: ">=0"
37+
- category: utils
38+
name: installer
39+
version: ">=0"
40+
- category: system
41+
name: cos-setup
42+
version: ">=0"
43+
- category: system
44+
name: immutable-rootfs
45+
version: ">=0"
46+
- category: system
47+
name: grub-config
48+
version: ">=0"
49+
- category: system
50+
name: cloud-config
51+
version: ">=0"
52+
- category: toolchain-fips
53+
name: luet
54+
version: ">=0"
2755
- name: "base-dracut-modules"
2856
category: "system"
2957
version: ">=0"

‎packages/templates/golang.yaml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -21,3 +21,9 @@
2121
mkdir -p /luetbuild/go/src/{{$host}}/{{$org}} && cd /luetbuild/go/src/{{$host}}/{{$org}} && \
2222
git clone https://{{$host}}/{{$org}}/{{$repo}} && cd {{$repo}} && git checkout "$PACKAGE_VERSION" -b build
2323
{{end}}
24+
25+
{{ define "golang_env" }}
26+
- PATH=$PATH:/usr/local/go/bin
27+
- GOPATH=/luetbuild/go
28+
- GO111MODULE=on
29+
{{end}}

‎packages/toolchain/build.yaml‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
requires:
2+
- name: "golang{{- if .Values.fips -}}-fips{{- end -}}"
3+
category: "build"
4+
version: ">=0"
5+
env:
6+
{{ template "golang_env" }}
7+
{{if .Values.fips}}
8+
- CGO_ENABLED=1
9+
{{ else }}
10+
- CGO_ENABLED=0
11+
- LDFLAGS="-s -w"
12+
{{ end }}
13+
14+
prelude:
15+
{{ template "golang_deps" .}}
16+
{{ $opts:= dict "version" .Values.version "org" ( index .Values.labels "github.owner" ) "repo" ( index .Values.labels "github.repo" ) }}
17+
{{ template "golang_download_package" $opts}}
18+
steps:
19+
- |
20+
PACKAGE_VERSION=${PACKAGE_VERSION%\+*} && \
21+
cd /luetbuild/go/src/github.com/{{ ( index .Values.labels "github.owner" ) }}/{{.Values.name}} && \
22+
buildtime=$(date -u '+%Y-%m-%d %I:%M:%S %Z') && \
23+
buildcommit=$(git rev-parse HEAD) && \
24+
go build -ldflags "$LDFLAGS -X \"github.com/{{ ( index .Values.labels "github.owner" ) }}/{{.Values.name}}/cmd.BuildTime=$buildtime\" -X \"github.com/{{ ( index .Values.labels "github.owner" ) }}/{{.Values.name}}/cmd.BuildCommit=$buildcommit\"" && \
25+
mv {{.Values.name}} /usr/bin/{{.Values.name}}
26+
{{ if .Values.fips }}
27+
# Check that we build with fips
28+
- go tool nm /usr/bin/{{.Values.name}} | grep '_Cfunc__goboringcrypto_' 1> /dev/null
29+
{{ end }}
30+
31+
includes:
32+
- /usr/bin/{{.Values.name}}

‎packages/toolchain/collection.yaml‎

Lines changed: 61 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,61 @@
1+
packages:
2+
- category: "toolchain"
3+
name: "luet"
4+
version: "0.17.6+1"
5+
branch: ""
6+
upx: false
7+
fips: false
8+
labels:
9+
github.repo: "luet"
10+
github.owner: "mudler"
11+
autobump.revdeps: "true"
12+
autobump.revbump_related: "system/cos recovery/cos recovery/cos-img recovery/cos-squash"
13+
- category: "toolchain-fips"
14+
name: "luet"
15+
version: "0.17.6+1"
16+
branch: ""
17+
upx: false
18+
fips: true
19+
labels:
20+
github.repo: "luet"
21+
github.owner: "mudler"
22+
autobump.revdeps: "true"
23+
autobump.revbump_related: "system/cos recovery/cos recovery/cos-img recovery/cos-squash"
24+
- name: "luet-makeiso"
25+
category: "toolchain"
26+
version: "0.3.4+1"
27+
upx: false
28+
fips: false
29+
labels:
30+
github.repo: "luet-makeiso"
31+
github.owner: "mudler"
32+
autobump.revdeps: "true"
33+
- name: "luet-makeiso"
34+
category: "toolchain-fips"
35+
version: "0.3.4+1"
36+
upx: false
37+
fips: true
38+
labels:
39+
github.repo: "luet-makeiso"
40+
github.owner: "mudler"
41+
autobump.revdeps: "true"
42+
- category: "toolchain-fips"
43+
name: "yip"
44+
upx: false
45+
fips: true
46+
version: "0.9.8+1"
47+
labels:
48+
github.repo: "yip"
49+
github.owner: "mudler"
50+
autobump.revdeps: "true"
51+
autobump.revbump_related: "system/cos recovery/cos recovery/cos-img recovery/cos-squash"
52+
- category: "toolchain"
53+
name: "yip"
54+
upx: false
55+
fips: false
56+
version: "0.9.8+1"
57+
labels:
58+
github.repo: "yip"
59+
github.owner: "mudler"
60+
autobump.revdeps: "true"
61+
autobump.revbump_related: "system/cos recovery/cos recovery/cos-img recovery/cos-squash"

‎packages/toolchain/luet-makeiso/build.yaml‎

Lines changed: 0 additions & 20 deletions
This file was deleted.

‎packages/toolchain/luet-makeiso/definition.yaml‎

Lines changed: 0 additions & 7 deletions
This file was deleted.

‎packages/toolchain/luet/build.yaml‎

Lines changed: 0 additions & 19 deletions
This file was deleted.

0 commit comments

Comments
 (0)