Skip to content

Commit d897d8a

Browse files
jvaughan-cloudflarejvaughan-cloudflare
committed
Add CI job to create a RHEL8 targeted binary with lower glibc version
1 parent 6000197 commit d897d8a

3 files changed

Lines changed: 188 additions & 0 deletions

File tree

‎.github/workflows/go.yml‎

Lines changed: 45 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,10 @@ on:
44
push:
55
pull_request:
66
branches: [master]
7+
8+
permissions:
9+
contents: read
10+
711
jobs:
812
test:
913
runs-on: ubuntu-latest
@@ -48,3 +52,44 @@ jobs:
4852
run: go install ./vendor/golang.org/x/lint/golint
4953
- name: Go Lint
5054
run: make gokeyless vet lint
55+
# Verify that the CGO binary built for RHEL 8 does not exceed GLIBC 2.28.
56+
# This catches upstream toolchain changes (e.g. goreleaser-cross base image
57+
# bumps) that silently raise the GLIBC floor. See SECENG-13556.
58+
build-el8:
59+
runs-on: ubuntu-latest
60+
container:
61+
image: rockylinux:8
62+
steps:
63+
- name: Install system dependencies
64+
run: dnf install -y gcc make libtool-ltdl-devel git findutils
65+
66+
- name: Checkout
67+
uses: actions/checkout@v6
68+
with:
69+
fetch-depth: 0
70+
71+
- name: Fix git ownership
72+
run: git config --global --add safe.directory "$GITHUB_WORKSPACE"
73+
74+
- name: Install Go 1.24.1
75+
run: |
76+
curl -sL https://go.dev/dl/go1.24.1.linux-amd64.tar.gz -o /tmp/go.tar.gz
77+
tar -C /usr/local -xzf /tmp/go.tar.gz
78+
rm /tmp/go.tar.gz
79+
ln -s /usr/local/go/bin/go /usr/local/bin/go
80+
ln -s /usr/local/go/bin/gofmt /usr/local/bin/gofmt
81+
go version
82+
83+
- name: Build gokeyless binary
84+
run: make build/usr/bin/gokeyless
85+
86+
- name: Verify GLIBC compatibility
87+
run: |
88+
MAX_GLIBC=$(objdump -T build/usr/bin/gokeyless | grep -oP 'GLIBC_\d+\.\d+' | sort -uV | tail -1)
89+
echo "Maximum GLIBC version required: $MAX_GLIBC"
90+
MAX_VER=$(echo "$MAX_GLIBC" | grep -oP '\d+\.\d+')
91+
if [ "$(printf '%s\n' "2.28" "$MAX_VER" | sort -V | tail -1)" != "2.28" ]; then
92+
echo "ERROR: Binary requires $MAX_GLIBC which is newer than GLIBC 2.28 (RHEL 8)"
93+
exit 1
94+
fi
95+
echo "OK: Binary is compatible with RHEL 8 (GLIBC 2.28)"

‎.github/workflows/release.yml‎

Lines changed: 83 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,89 @@ jobs:
2525
- run: make release-github
2626
env:
2727
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
28+
# Build a GLIBC 2.28-compatible RPM for RHEL 8 / EL8 customers.
29+
# The main goreleaser job builds inside goreleaser-cross (Ubuntu 24.04,
30+
# GLIBC 2.39) which produces binaries incompatible with RHEL 8.
31+
# This job compiles inside Rocky Linux 8 (GLIBC 2.28) to guarantee
32+
# compatibility. See: SECENG-13556, ESCALATION-2261
33+
build-el8-rpm:
34+
runs-on: ubuntu-latest
35+
needs: goreleaser # release must exist before we can upload assets
36+
container:
37+
image: rockylinux:8
38+
steps:
39+
- name: Install system dependencies
40+
run: |
41+
dnf install -y gcc make libtool-ltdl-devel git findutils
42+
43+
- name: Checkout
44+
uses: actions/checkout@v6
45+
with:
46+
fetch-depth: 0
47+
48+
- name: Fix git ownership
49+
run: git config --global --add safe.directory "$GITHUB_WORKSPACE"
50+
51+
- name: Install Go 1.24.1
52+
run: |
53+
curl -sL https://go.dev/dl/go1.24.1.linux-amd64.tar.gz -o /tmp/go.tar.gz
54+
tar -C /usr/local -xzf /tmp/go.tar.gz
55+
rm /tmp/go.tar.gz
56+
# Make Go available for subsequent steps
57+
ln -s /usr/local/go/bin/go /usr/local/bin/go
58+
ln -s /usr/local/go/bin/gofmt /usr/local/bin/gofmt
59+
go version
60+
61+
- name: Build gokeyless binary
62+
run: make build/usr/bin/gokeyless
63+
64+
- name: Verify GLIBC compatibility
65+
run: |
66+
# Ensure the binary does not require GLIBC newer than 2.28
67+
objdump -T build/usr/bin/gokeyless | grep -oP 'GLIBC_\d+\.\d+' | sort -uV | tail -1
68+
MAX_GLIBC=$(objdump -T build/usr/bin/gokeyless | grep -oP 'GLIBC_\d+\.\d+' | sort -uV | tail -1)
69+
echo "Maximum GLIBC version required: $MAX_GLIBC"
70+
# Extract version number and compare
71+
MAX_VER=$(echo "$MAX_GLIBC" | grep -oP '\d+\.\d+')
72+
if [ "$(printf '%s\n' "2.28" "$MAX_VER" | sort -V | tail -1)" != "2.28" ]; then
73+
echo "ERROR: Binary requires $MAX_GLIBC which is newer than GLIBC 2.28 (RHEL 8)"
74+
exit 1
75+
fi
76+
echo "OK: Binary is compatible with RHEL 8 (GLIBC 2.28)"
77+
78+
- name: Install nfpm
79+
run: |
80+
curl -sL https://github.com/goreleaser/nfpm/releases/download/v2.46.3/nfpm_2.46.3_Linux_x86_64.tar.gz -o /tmp/nfpm.tar.gz
81+
tar -C /usr/local/bin -xzf /tmp/nfpm.tar.gz nfpm
82+
rm /tmp/nfpm.tar.gz
83+
84+
- name: Determine version
85+
id: version
86+
run: |
87+
# Strip leading 'v' from the tag to get the version number
88+
VERSION="${GITHUB_REF_NAME#v}"
89+
echo "version=$VERSION" >> $GITHUB_OUTPUT
90+
91+
- name: Build el8 RPM
92+
run: |
93+
nfpm package \
94+
--config nfpm-el8.yml \
95+
--packager rpm \
96+
--target "gokeyless-${VERSION}-1.el8.x86_64.rpm"
97+
env:
98+
VERSION: ${{ steps.version.outputs.version }}
99+
100+
- name: Upload RPM to GitHub release
101+
run: |
102+
# Install gh CLI
103+
dnf install -y 'dnf-command(config-manager)'
104+
dnf config-manager --add-repo https://cli.github.com/packages/rpm/gh-cli.repo
105+
dnf install -y gh
106+
# Upload the el8 RPM as a release asset
107+
gh release upload "$GITHUB_REF_NAME" gokeyless-*.el8.x86_64.rpm --clobber
108+
env:
109+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
110+
28111
build-and-push-image:
29112
runs-on: ubuntu-latest
30113
permissions:

‎nfpm-el8.yml‎

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
# nfpm configuration for building RHEL 8 / EL8-compatible RPM packages.
2+
#
3+
# This exists because the main goreleaser pipeline builds inside
4+
# ghcr.io/goreleaser/goreleaser-cross:latest (Ubuntu 24.04, GLIBC 2.39),
5+
# producing binaries that are incompatible with RHEL 8 (GLIBC 2.28).
6+
#
7+
# This config is used by the build-el8-rpm CI job which compiles inside
8+
# a Rocky Linux 8 container to guarantee GLIBC 2.28 compatibility.
9+
#
10+
# See: SECENG-13556, ESCALATION-2261
11+
12+
name: gokeyless
13+
arch: amd64
14+
platform: linux
15+
version: ${VERSION}
16+
maintainer: SSL Cloudflare <security-engineering@cloudflare.com>
17+
description: Go implementation of keyless protocol
18+
vendor: Cloudflare
19+
homepage: https://github.com/cloudflare/gokeyless
20+
license: Cloudflare
21+
22+
depends:
23+
- libtool-ltdl
24+
25+
contents:
26+
- src: build/usr/bin/gokeyless
27+
dst: /usr/bin/gokeyless
28+
file_info:
29+
mode: 0755
30+
31+
- src: pkg/gokeyless.service
32+
dst: /lib/systemd/system/gokeyless.service
33+
file_info:
34+
mode: 0644
35+
36+
- src: pkg/gokeyless.sysv
37+
dst: /etc/init.d/gokeyless
38+
type: config
39+
file_info:
40+
mode: 0755
41+
42+
- src: pkg/keyless_cacert.pem
43+
dst: /etc/keyless/keyless_cacert.pem
44+
type: config
45+
file_info:
46+
mode: 0644
47+
48+
- src: pkg/gokeyless.yaml
49+
dst: /etc/keyless/gokeyless.yaml
50+
type: config|noreplace
51+
file_info:
52+
mode: 0600
53+
54+
scripts:
55+
preinstall: pkg/centos/before-install.sh
56+
postinstall: pkg/centos/after-install.sh
57+
preremove: pkg/centos/before-remove.sh
58+
59+
rpm:
60+
group: System Environment/Daemons

0 commit comments

Comments
 (0)