Skip to content

Commit 91d39e1

Browse files
motatoesmotatoes
authored
enable fips140 builds (#1952)
* enable fips140 builds * fix * support fips in gha * fix build stage * add docs
1 parent 20cefd9 commit 91d39e1

File tree

9 files changed

+143
-3
lines changed

9 files changed

+143
-3
lines changed

‎.github/workflows/ee_backend_docker_release.yml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -45,3 +45,5 @@ jobs:
4545
push: true
4646
tags: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest, ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.event.release.tag_name }}
4747
labels: ${{ steps.meta.outputs.labels }}
48+
49+

‎.github/workflows/ee_backend_docker_release_fips.yml

Lines changed: 51 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
---
2+
name: EE Backend Publish docker image
3+
4+
"on":
5+
release:
6+
types:
7+
- 'released'
8+
9+
env:
10+
REGISTRY: ghcr.io
11+
IMAGE_NAME: ${{ github.repository }}_backend_ee_fips
12+
13+
jobs:
14+
build-and-push-image:
15+
if: (startswith(github.event.release.tag_name, 'v'))
16+
17+
runs-on: ubuntu-latest
18+
19+
permissions:
20+
contents: read
21+
packages: write
22+
23+
steps:
24+
- name: Checkout repository
25+
uses: actions/checkout@v4
26+
27+
- name: Log in to the Container registry
28+
uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772
29+
with:
30+
registry: ${{ env.REGISTRY }}
31+
username: ${{ github.actor }}
32+
password: ${{ secrets.GITHUB_TOKEN }}
33+
34+
- name: Extract metadata (tags, labels) for Docker
35+
id: meta
36+
uses: docker/metadata-action@v5.5.1
37+
with:
38+
images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
39+
40+
- name: Build and push Docker image
41+
uses: docker/build-push-action@v5.3.0
42+
with:
43+
context: .
44+
file: "Dockerfile_backend_ee"
45+
push: true
46+
tags: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest, ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.event.release.tag_name }}
47+
labels: ${{ steps.meta.outputs.labels }}
48+
build-args: |
49+
GODEBUG_VALUE=fips140=only
50+
GOFIPS140_VALUE=v1.0.0
51+

‎.github/workflows/ee_cli_release_fips.yml

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
---
2+
name: release ee cli
3+
4+
"on":
5+
release:
6+
branches:
7+
- 'go'
8+
types:
9+
- 'released'
10+
11+
jobs:
12+
binary:
13+
runs-on: ubuntu-latest
14+
15+
steps:
16+
- name: Download Go
17+
uses: actions/setup-go@v5
18+
with:
19+
go-version: 1.24.0
20+
id: go
21+
22+
- name: Check out repository
23+
uses: actions/checkout@v4
24+
25+
- name: Publish linux-x64 exec to github
26+
id: build-and-release-binary
27+
uses: wangyoucao577/go-release-action@8fa1e8368c8465264d64e0198208e10f71474c87 # v1.50
28+
with:
29+
github_token: ${{ secrets.GITHUB_TOKEN }}
30+
goos: linux
31+
goarch: amd64
32+
goversion: 1.24.0
33+
project_path: ./ee/cli/cmd/digger
34+
binary_name: digger
35+
pre_command: export CGO_ENABLED=0
36+
sha256sum: true
37+
md5sum: false
38+
asset_name: "digger-ee-cli-Linux-X64-fips"
39+
compress_assets: "OFF"
40+
env:
41+
GODEBUG: fips140=only
42+
GOFIPS140: v1.0.0
43+

‎Dockerfile_backend_ee

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -20,8 +20,16 @@ RUN go build -ldflags="-X 'main.Version=${COMMIT_SHA}'" -o backend_exe ./ee/back
2020

2121
# Multi-stage build will just copy the binary to an alpine image.
2222
FROM ubuntu:24.04 as runner
23-
ENV ATLAS_VERSION v0.31.0
23+
2424
ARG COMMIT_SHA
25+
ARG GODEBUG_VALUE=off
26+
ARG GOFIPS140_VALUE=off
27+
28+
# Set environment variables using the build arguments
29+
ENV GODEBUG=$GODEBUG_VALUE
30+
ENV GOFIPS140=$GOFIPS140_VALUE
31+
ENV ATLAS_VERSION v0.31.0
32+
2533
WORKDIR /app
2634

2735
RUN apt-get update && apt-get install -y ca-certificates curl && apt-get install -y git && apt-get clean all

‎action.yml

Lines changed: 13 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,10 @@ inputs:
88
description: use ee cli?
99
required: false
1010
default: 'false'
11+
fips:
12+
description: build with fips140 standard?
13+
required: false
14+
default: 'false'
1115
setup-aws:
1216
description: Setup AWS
1317
required: false
@@ -427,6 +431,10 @@ runs:
427431
else
428432
cd $GITHUB_ACTION_PATH/cli
429433
fi
434+
if [[ ${{ inputs.fips }} == "true" ]]; then
435+
export GODEBUG=fips140=only
436+
export GOFIPS140=v1.0.0
437+
fi
430438
go build -o digger ./cmd/digger
431439
chmod +x digger
432440
PATH=$PATH:$(pwd)
@@ -467,7 +475,11 @@ runs:
467475
shell: bash
468476
run: |
469477
if [[ ${{ inputs.ee }} == "true" ]]; then
470-
curl -sL https://github.com/diggerhq/digger/releases/download/${actionref}/digger-ee-cli-${{ runner.os }}-${{ runner.arch }} -o digger
478+
if [[ ${{ inputs.fips }} == "true" ]]; then
479+
curl -sL https://github.com/diggerhq/digger/releases/download/${actionref}/digger-ee-cli-${{ runner.os }}-${{ runner.arch }}-fips -o digger
480+
else
481+
curl -sL https://github.com/diggerhq/digger/releases/download/${actionref}/digger-ee-cli-${{ runner.os }}-${{ runner.arch }} -o digger
482+
fi
471483
else
472484
curl -sL https://github.com/diggerhq/digger/releases/download/${actionref}/digger-cli-${{ runner.os }}-${{ runner.arch }} -o digger
473485
fi

‎cli/cmd/digger/default.go

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,7 @@ import (
1919
)
2020

2121
func initLogger() {
22+
2223
logLevel := os.Getenv("DIGGER_LOG_LEVEL")
2324
var level slog.Leveler
2425
if logLevel == "DEBUG" {

‎docs/ee/fips-140.mdx

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
---
2+
title: "FIPS 140 build"
3+
---
4+
5+
You can use digger binary with FIPS140 standard. FIPS 140 (Federal Information Processing Standard Publication 140) is a U.S. government standard that specifies security requirements for cryptographic modules protecting sensitive information.
6+
7+
as of version v0.6.101 digger backend and cli are both compiled seperately with FIPS140 enabled. In order to enable it for github follow these steps:
8+
9+
- For the backend you need to ensure you use the right docker image: `_backend_ee_fips` during the pull
10+
- For the cli you need to add the following argument in addition to `ee: true` :
11+
12+
```
13+
- diggerhq/digger@vLatest
14+
with:
15+
ee: 'true'
16+
fips: 'true'
17+
```
18+
19+
If you are using gitlab or other VCS then just ensure that you are downloading the fips enabled binary which is suffixed with '_fips'

‎ee/backend/main.go

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
11
package main
22

33
import (
4+
"crypto/fips140"
45
"embed"
56
"fmt"
67
"github.com/diggerhq/digger/backend/bootstrap"
@@ -31,6 +32,8 @@ func main() {
3132
log.Printf("error checking license %v", err)
3233
os.Exit(1)
3334
}
35+
36+
log.Printf("fips140 enabled: %v", fips140.Enabled())
3437
githubProvider := github.DiggerGithubEEClientProvider{}
3538
diggerController := ce_controllers.DiggerController{
3639
CiBackendProvider: ci_backends2.EEBackendProvider{},

‎ee/cli/cmd/digger/default.go

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
11
package main
22

33
import (
4+
"crypto/fips140"
45
"encoding/json"
56
"fmt"
67
"github.com/diggerhq/digger/cli/pkg/digger"
@@ -24,8 +25,8 @@ import (
2425
var defaultCmd = &cobra.Command{
2526
Use: "default",
2627
Run: func(cmd *cobra.Command, args []string) {
27-
2828
specStr := os.Getenv("DIGGER_RUN_SPEC")
29+
log.Printf("Fips140 enabled in build: %v", fips140.Enabled())
2930
if specStr != "" {
3031
var spec lib_spec.Spec
3132
err := json.Unmarshal([]byte(specStr), &spec)

0 commit comments

Comments
 (0)