Skip to content

Commit 2bf42f5

Browse files
JasonPowrJasonPowr
committed
ci: add fips check
1 parent dd2969f commit 2bf42f5

File tree

4 files changed

+44
-49
lines changed

4 files changed

+44
-49
lines changed

‎.tekton/gitsign-pull-request.yaml‎

Lines changed: 14 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -40,21 +40,30 @@ spec:
4040
value: "true"
4141
- name: go_test_command
4242
value: go test $(go list ./... | grep -v github.com/sigstore/gitsign/pkg/version)
43+
- name: build-platforms
44+
value:
45+
- linux/x86_64
46+
- linux/arm64
47+
- linux/ppc64le
48+
- linux/s390x
49+
- name: fips-check
50+
value: "true"
4351
pipelineRef:
4452
params:
4553
- name: url
4654
value: https://github.com/securesign/pipelines.git
4755
- name: revision
4856
value: main
4957
- name: pathInRepo
50-
value: pipelines/docker-build-oci-ta.yaml
58+
value: pipelines/docker-build-multi-platform-oci-ta.yaml
5159
resolver: git
5260
taskRunSpecs:
5361
- pipelineTaskName: run-unit-test
54-
podTemplate:
55-
imagePullSecrets:
56-
- name: brew-registry-pull-secret
57-
serviceAccountName: appstudio-pipeline
62+
stepSpecs:
63+
- computeResources:
64+
limits:
65+
memory: 4Gi
66+
name: run-tests
5867
taskRunTemplate:
5968
serviceAccountName: build-pipeline-gitsign
6069
workspaces:

‎.tekton/gitsign-push.yaml‎

Lines changed: 14 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -37,21 +37,30 @@ spec:
3737
value: "true"
3838
- name: go_test_command
3939
value: go test $(go list ./... | grep -v github.com/sigstore/gitsign/pkg/version)
40+
- name: build-platforms
41+
value:
42+
- linux/x86_64
43+
- linux/arm64
44+
- linux/ppc64le
45+
- linux/s390x
46+
- name: fips-check
47+
value: "true"
4048
pipelineRef:
4149
params:
4250
- name: url
4351
value: https://github.com/securesign/pipelines.git
4452
- name: revision
4553
value: main
4654
- name: pathInRepo
47-
value: pipelines/docker-build-oci-ta.yaml
55+
value: pipelines/docker-build-multi-platform-oci-ta.yaml
4856
resolver: git
4957
taskRunSpecs:
5058
- pipelineTaskName: run-unit-test
51-
podTemplate:
52-
imagePullSecrets:
53-
- name: brew-registry-pull-secret
54-
serviceAccountName: appstudio-pipeline
59+
stepSpecs:
60+
- computeResources:
61+
limits:
62+
memory: 4Gi
63+
name: run-tests
5564
taskRunTemplate:
5665
serviceAccountName: build-pipeline-gitsign
5766
workspaces:

‎Build.mak‎

Lines changed: 5 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,3 @@
1-
21
GIT_VERSION ?= $(shell git describe --tags --always --dirty)
32

43
GIT_HASH ?= $(shell git rev-parse HEAD)
@@ -16,34 +15,19 @@ ifeq ($(DIFF), 1)
1615
endif
1716

1817
LDFLAGS=-buildid= -X github.com/sigstore/gitsign/pkg/version.gitVersion=$(GIT_VERSION)
18+
FIPS_MODULE ?= latest
1919

2020
.PHONY:
21-
cross-platform: gitsign-cli-darwin-arm64 gitsign-cli-darwin-amd64 gitsign-cli-linux-amd64 gitsign-cli-linux-arm64 gitsign-cli-linux-ppc64le gitsign-cli-linux-s390x gitsign-cli-windows ## Build all distributable (cross-platform) binaries
21+
cross-platform: gitsign-cli-darwin-arm64 gitsign-cli-darwin-amd64 gitsign-cli-windows ## Build all distributable (cross-platform) binaries
2222

2323
.PHONY: gitsign-cli-darwin-arm64
2424
gitsign-cli-darwin-arm64: ## Build for mac M1
25-
env CGO_ENABLED=0 GOOS=darwin GOARCH=arm64 go build -mod=readonly -o gitsign_cli_darwin_arm64 -trimpath -ldflags "$(LDFLAGS) -w -s" .
25+
env CGO_ENABLED=0 GOFIPS140=$(FIPS_MODULE) GOOS=darwin GOARCH=arm64 go build -mod=readonly -o gitsign_cli_darwin_arm64 -trimpath -ldflags "$(LDFLAGS) -w -s" .
2626

2727
.PHONY: gitsign-cli-darwin-amd64
2828
gitsign-cli-darwin-amd64: ## Build for Darwin (macOS)
29-
env CGO_ENABLED=0 GOOS=darwin GOARCH=amd64 go build -mod=readonly -o gitsign_cli_darwin_amd64 -trimpath -ldflags "$(LDFLAGS) -w -s" .
30-
31-
.PHONY: gitsign-cli-linux-amd64
32-
gitsign-cli-linux-amd64: ## Build for Linux amd64
33-
env CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build -mod=readonly -o gitsign_cli_linux_amd64 -trimpath -ldflags "$(LDFLAGS) -w -s" .
34-
35-
.PHONY: gitsign-cli-linux-arm64
36-
gitsign-cli-linux-arm64: ## Build for Linux arm64
37-
env CGO_ENABLED=0 GOOS=linux GOARCH=arm64 go build -mod=readonly -o gitsign_cli_linux_arm64 -trimpath -ldflags "$(LDFLAGS) -w -s" .
38-
39-
.PHONY: gitsign-cli-linux-ppc64le
40-
gitsign-cli-linux-ppc64le: ## Build for Linux ppc64le
41-
env CGO_ENABLED=0 GOOS=linux GOARCH=ppc64le go build -mod=readonly -o gitsign_cli_linux_ppc64le -trimpath -ldflags "$(LDFLAGS) -w -s" .
42-
43-
.PHONY: gitsign-cli-linux-s390x
44-
gitsign-cli-linux-s390x: ## Build for Linux s390x
45-
env CGO_ENABLED=0 GOOS=linux GOARCH=s390x go build -mod=readonly -o gitsign_cli_linux_s390x -trimpath -ldflags "$(LDFLAGS) -w -s" .
29+
env CGO_ENABLED=0 GOFIPS140=$(FIPS_MODULE) GOOS=darwin GOARCH=amd64 go build -mod=readonly -o gitsign_cli_darwin_amd64 -trimpath -ldflags "$(LDFLAGS) -w -s" .
4630

4731
.PHONY: gitsign-cli-windows
4832
gitsign-cli-windows: ## Build for Windows
49-
env CGO_ENABLED=0 GOOS=windows GOARCH=amd64 go build -mod=readonly -o gitsign_cli_windows_amd64.exe -trimpath -ldflags "$(LDFLAGS) -w -s" .
33+
env CGO_ENABLED=0 GOFIPS140=$(FIPS_MODULE) GOOS=windows GOARCH=amd64 go build -mod=readonly -o gitsign_cli_windows_amd64.exe -trimpath -ldflags "$(LDFLAGS) -w -s" .

‎Dockerfile.gitsign.rh‎

Lines changed: 11 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
# Build stage
2-
FROM registry.redhat.io/ubi9/go-toolset:9.6@sha256:7b1828de52c3bac600a71b81996bf748776a456181a45e2b329b39702cf6486f AS build-env
2+
FROM registry.redhat.io/ubi9/go-toolset:9.6 AS build-env
33

44
ENV GOEXPERIMENT=strictfipsruntime
55
ENV CGO_ENABLED=1
@@ -14,15 +14,16 @@ RUN git stash && \
1414
export BUILD_DATE=$(date -u +'%Y-%m-%dT%H:%M:%SZ') && \
1515
git stash pop || true && \
1616
go mod download && \
17+
LDFLAGS="-X sigs.k8s.io/release-utils/version.gitVersion=${GIT_VERSION} \
18+
-X sigs.k8s.io/release-utils/version.gitCommit=${GIT_HASH} \
19+
-X sigs.k8s.io/release-utils/version.gitTreeState="clean" \
20+
-X sigs.k8s.io/release-utils/version.buildDate=${BUILD_DATE}"; \
21+
go build -mod=readonly -o gitsign_cli_linux -trimpath -ldflags "${LDFLAGS} -w -s" . && \
22+
gzip -k gitsign_cli_linux && \
1723
make -f Build.mak cross-platform && \
1824
gzip gitsign_cli_darwin_amd64 && \
19-
gzip gitsign_cli_linux_amd64 && \
2025
gzip gitsign_cli_windows_amd64.exe && \
21-
gzip gitsign_cli_darwin_arm64 && \
22-
gzip gitsign_cli_linux_arm64 && \
23-
gzip gitsign_cli_linux_ppc64le && \
24-
gzip gitsign_cli_linux_s390x && \
25-
ls -la
26+
gzip gitsign_cli_darwin_arm64
2627

2728
# Install Gitsign
2829
FROM registry.access.redhat.com/ubi9-minimal@sha256:34880b64c07f28f64d95737f82f891516de9a3b43583f39970f7bf8e4cfa48b7
@@ -35,30 +36,22 @@ LABEL summary="Provides the gitsign CLI binary for signing and verifying contain
3536
LABEL com.redhat.component="gitsign"
3637
LABEL name="rhtas/gitsign-rhel9"
3738

39+
COPY --from=build-env /gitsign/gitsign_cli_linux /usr/local/bin/gitsign_cli_linux
40+
COPY --from=build-env /gitsign/gitsign_cli_linux.gz /usr/local/bin/gitsign_cli_linux.gz
3841
COPY --from=build-env /gitsign/gitsign_cli_darwin_amd64.gz /usr/local/bin/gitsign_cli_darwin_amd64.gz
39-
COPY --from=build-env /gitsign/gitsign_cli_linux_amd64.gz /usr/local/bin/gitsign_cli_linux_amd64.gz
4042
COPY --from=build-env /gitsign/gitsign_cli_darwin_arm64.gz /usr/local/bin/gitsign_cli_darwin_arm64.gz
41-
COPY --from=build-env /gitsign/gitsign_cli_linux_arm64.gz /usr/local/bin/gitsign_cli_linux_arm64.gz
42-
COPY --from=build-env /gitsign/gitsign_cli_linux_ppc64le.gz /usr/local/bin/gitsign_cli_linux_ppc64le.gz
43-
COPY --from=build-env /gitsign/gitsign_cli_linux_s390x.gz /usr/local/bin/gitsign_cli_linux_s390x.gz
4443
COPY --from=build-env /gitsign/gitsign_cli_windows_amd64.exe.gz /usr/local/bin/gitsign_cli_windows_amd64.exe.gz
4544
COPY LICENSE /licenses/license.txt
4645

47-
4846
ENV HOME=/home
4947
WORKDIR ${HOME}
5048

5149
RUN chown root:0 /usr/local/bin/gitsign_cli_darwin_amd64.gz && chmod g+wx /usr/local/bin/gitsign_cli_darwin_amd64.gz && \
52-
chown root:0 /usr/local/bin/gitsign_cli_linux_amd64.gz && chmod g+wx /usr/local/bin/gitsign_cli_linux_amd64.gz && \
5350
chown root:0 /usr/local/bin/gitsign_cli_windows_amd64.exe.gz && chmod g+wx /usr/local/bin/gitsign_cli_windows_amd64.exe.gz && \
54-
chown root:0 /usr/local/bin/gitsign_cli_linux_arm64.gz && chmod g+wx /usr/local/bin/gitsign_cli_linux_arm64.gz && \
5551
chown root:0 /usr/local/bin/gitsign_cli_darwin_arm64.gz && chmod g+wx /usr/local/bin/gitsign_cli_darwin_arm64.gz && \
56-
chown root:0 /usr/local/bin/gitsign_cli_linux_ppc64le.gz && chmod g+wx /usr/local/bin/gitsign_cli_linux_ppc64le.gz && \
57-
chown root:0 /usr/local/bin/gitsign_cli_linux_s390x.gz && chmod g+wx /usr/local/bin/gitsign_cli_linux_s390x.gz && \
52+
chown root:0 /usr/local/bin/gitsign_cli_linux.gz && chmod g+wx /usr/local/bin/gitsign_cli_linux.gz && \
5853
chgrp -R 0 /${HOME} && chmod -R g=u /${HOME}
5954

60-
LABEL com.redhat.component="gitsign"
61-
6255
USER 65532:65532
6356

6457
# Makes sure the container stays running

0 commit comments

Comments
 (0)