Skip to content

Commit a2a664e

Browse files
JasonPowrJasonPowr
authored
Merge pull request #466 from securesign/add-fips-check
Add fips check
2 parents 17a86fc + 581818d commit a2a664e

File tree

6 files changed

+41
-43
lines changed

6 files changed

+41
-43
lines changed

‎.tekton/client-server-pull-request.yaml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -33,6 +33,8 @@ spec:
3333
value: "true"
3434
- name: build-source-image
3535
value: "true"
36+
- name: fips-check
37+
value: "true"
3638
pipelineRef:
3739
params:
3840
- name: url

‎.tekton/client-server-push.yaml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -30,6 +30,8 @@ spec:
3030
value: "true"
3131
- name: build-source-image
3232
value: "true"
33+
- name: fips-check
34+
value: "true"
3335
pipelineRef:
3436
params:
3537
- name: url

‎.tekton/cosign-pull-request.yaml‎

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -41,14 +41,22 @@ spec:
4141
value: "true"
4242
- name: go_unit_test
4343
value: "true"
44+
- name: build-platforms
45+
value:
46+
- linux/x86_64
47+
- linux/arm64
48+
- linux/ppc64le
49+
- linux/s390x
50+
- name: fips-check
51+
value: "true"
4452
pipelineRef:
4553
params:
4654
- name: url
4755
value: https://github.com/securesign/pipelines.git
4856
- name: revision
4957
value: main
5058
- name: pathInRepo
51-
value: pipelines/docker-build-oci-ta.yaml
59+
value: pipelines/docker-build-multi-platform-oci-ta.yaml
5260
resolver: git
5361
taskRunSpecs:
5462
- pipelineTaskName: run-unit-test

‎.tekton/cosign-push.yaml‎

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -38,14 +38,22 @@ spec:
3838
value: "true"
3939
- name: go_unit_test
4040
value: "true"
41+
- name: build-platforms
42+
value:
43+
- linux/x86_64
44+
- linux/arm64
45+
- linux/ppc64le
46+
- linux/s390x
47+
- name: fips-check
48+
value: "true"
4149
pipelineRef:
4250
params:
4351
- name: url
4452
value: https://github.com/securesign/pipelines.git
4553
- name: revision
4654
value: main
4755
- name: pathInRepo
48-
value: pipelines/docker-build-oci-ta.yaml
56+
value: pipelines/docker-build-multi-platform-oci-ta.yaml
4957
resolver: git
5058
taskRunSpecs:
5159
- pipelineTaskName: run-unit-test

‎Build.mak‎

Lines changed: 5 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,3 @@
1-
21
GIT_VERSION ?= $(shell git describe --tags --always --dirty)
32
GIT_HASH ?= $(shell git rev-parse HEAD)
43
DATE_FMT = +%Y-%m-%dT%H:%M:%SZ
@@ -18,34 +17,19 @@ LDFLAGS=-buildid= -X sigs.k8s.io/release-utils/version.gitVersion=$(GIT_VERSION)
1817
-X sigs.k8s.io/release-utils/version.gitCommit=$(GIT_HASH) \
1918
-X sigs.k8s.io/release-utils/version.gitTreeState=$(GIT_TREESTATE) \
2019
-X sigs.k8s.io/release-utils/version.buildDate=$(BUILD_DATE)
20+
FIPS_MODULE ?= latest
2121

2222
.PHONY:
23-
cross-platform: cosign-darwin-arm64 cosign-darwin-amd64 cosign-linux-amd64 cosign-linux-arm64 cosign-linux-ppc64le cosign-linux-s390x cosign-windows-amd64 ## Build all distributable (cross-platform) binaries
23+
cross-platform: cosign-darwin-arm64 cosign-darwin-amd64 cosign-windows-amd64 ## Build all distributable (cross-platform) binaries
2424

2525
.PHONY: cosign-darwin-arm64
2626
cosign-darwin-arm64: ## Build for mac M1
27-
env CGO_ENABLED=0 GOOS=darwin GOARCH=arm64 go build -o cosign-darwin-arm64 -trimpath -ldflags "$(LDFLAGS) -w -s" ./cmd/cosign
27+
env CGO_ENABLED=0 GOFIPS140=$(FIPS_MODULE) GOOS=darwin GOARCH=arm64 go build -o cosign-darwin-arm64 -trimpath -ldflags "$(LDFLAGS) -w -s" ./cmd/cosign
2828

2929
.PHONY: cosign-darwin-amd64
3030
cosign-darwin-amd64: ## Build for Darwin (macOS)
31-
env CGO_ENABLED=0 GOOS=darwin GOARCH=amd64 go build -o cosign-darwin-amd64 -trimpath -ldflags "$(LDFLAGS) -w -s" ./cmd/cosign
32-
33-
.PHONY: cosign-linux-amd64
34-
cosign-linux-amd64: ## Build for Linux amd64
35-
env CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build -o cosign-linux-amd64 -trimpath -ldflags "$(LDFLAGS) -w -s" ./cmd/cosign
36-
37-
.PHONY: cosign-linux-arm64
38-
cosign-linux-arm64: ## Build for Linux arm64
39-
env CGO_ENABLED=0 GOOS=linux GOARCH=arm64 go build -o cosign-linux-arm64 -trimpath -ldflags "$(LDFLAGS) -w -s" ./cmd/cosign
40-
41-
.PHONY: cosign-linux-ppc64le
42-
cosign-linux-ppc64le: ## Build for Linux ppc64le
43-
env CGO_ENABLED=0 GOOS=linux GOARCH=ppc64le go build -o cosign-linux-ppc64le -trimpath -ldflags "$(LDFLAGS) -w -s" ./cmd/cosign
44-
45-
.PHONY: cosign-linux-s390x
46-
cosign-linux-s390x: ## Build for Linux s390x
47-
env CGO_ENABLED=0 GOOS=linux GOARCH=s390x go build -o cosign-linux-s390x -trimpath -ldflags "$(LDFLAGS) -w -s" ./cmd/cosign
31+
env CGO_ENABLED=0 GOFIPS140=$(FIPS_MODULE) GOOS=darwin GOARCH=amd64 go build -o cosign-darwin-amd64 -trimpath -ldflags "$(LDFLAGS) -w -s" ./cmd/cosign
4832

4933
.PHONY: cosign-windows-amd64
5034
cosign-windows-amd64: ## Build for Windows
51-
env CGO_ENABLED=0 GOOS=windows GOARCH=amd64 go build -o cosign-windows-amd64.exe -trimpath -ldflags "$(LDFLAGS) -w -s" ./cmd/cosign
35+
env CGO_ENABLED=0 GOFIPS140=$(FIPS_MODULE) GOOS=windows GOARCH=amd64 go build -o cosign-windows-amd64.exe -trimpath -ldflags "$(LDFLAGS) -w -s" ./cmd/cosign

‎Dockerfile.cosign.rh‎

Lines changed: 14 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,5 @@
11
# Build stage
2-
3-
FROM registry.redhat.io/ubi9/go-toolset:9.7@sha256:380d6de9bbc5a42ca13d425be99958fb397317664bb8a00e49d464e62cc8566c AS build-env
2+
FROM registry.redhat.io/ubi9/go-toolset:9.7 AS build-env
43

54
ENV GOEXPERIMENT=strictfipsruntime
65
ENV CGO_ENABLED=1
@@ -14,12 +13,14 @@ RUN git config --global --add safe.directory /cosign && \
1413
export GIT_HASH=$(git rev-parse HEAD) && \
1514
export BUILD_DATE=$(date -u +'%Y-%m-%dT%H:%M:%SZ') && \
1615
go mod vendor && \
16+
GIT_TREESTATE=clean && \
17+
LDFLAGS="-X sigs.k8s.io/release-utils/version.gitVersion=${GIT_VERSION} \
18+
-X sigs.k8s.io/release-utils/version.gitCommit=${GIT_HASH} \
19+
-X sigs.k8s.io/release-utils/version.gitTreeState=${GIT_TREESTATE} \
20+
-X sigs.k8s.io/release-utils/version.buildDate=${BUILD_DATE}"; \
21+
go build -o cosign-linux -trimpath -ldflags "${LDFLAGS} -w -s" ./cmd/cosign && \
22+
gzip -k cosign-linux && \
1723
make -f Build.mak cross-platform && \
18-
cp cosign-linux-amd64 cosign && \
19-
gzip cosign-linux-amd64 && \
20-
gzip cosign-linux-ppc64le && \
21-
gzip cosign-linux-s390x && \
22-
gzip cosign-linux-arm64 && \
2324
gzip cosign-darwin-amd64 && \
2425
gzip cosign-darwin-arm64 && \
2526
gzip cosign-windows-amd64.exe && \
@@ -36,27 +37,20 @@ LABEL summary="Provides the cosign CLI binary for signing and verifying containe
3637
LABEL com.redhat.component="cosign"
3738
LABEL name="rhtas/cosign-rhel9"
3839

40+
COPY --from=build-env /cosign/cosign-linux /usr/local/bin/cosign
41+
COPY --from=build-env /cosign/cosign-linux.gz /usr/local/bin/cosign.gz
3942
COPY --from=build-env /cosign/cosign-darwin-amd64.gz /usr/local/bin/cosign-darwin-amd64.gz
4043
COPY --from=build-env /cosign/cosign-windows-amd64.exe.gz /usr/local/bin/cosign-windows-amd64.exe.gz
4144
COPY --from=build-env /cosign/cosign-darwin-arm64.gz /usr/local/bin/cosign-darwin-arm64.gz
42-
COPY --from=build-env /cosign/cosign-linux-arm64.gz /usr/local/bin/cosign-linux-arm64.gz
43-
COPY --from=build-env /cosign/cosign-linux-ppc64le.gz /usr/local/bin/cosign-linux-ppc64le.gz
44-
COPY --from=build-env /cosign/cosign-linux-s390x.gz /usr/local/bin/cosign-linux-s390x.gz
45-
COPY --from=build-env /cosign/cosign-linux-amd64.gz /usr/local/bin/cosign-linux-amd64.gz
46-
COPY --from=build-env /cosign/cosign /usr/local/bin/cosign
4745
COPY LICENSE /licenses/license.txt
4846

49-
RUN chown root:0 /usr/local/bin/cosign && \
50-
chmod g+wx /usr/local/bin/cosign && \
47+
RUN chown root:0 /usr/local/bin/cosign && chmod g+wx /usr/local/bin/cosign && \
48+
chown root:0 /usr/local/bin/cosign.gz && chmod g+wx /usr/local/bin/cosign.gz && \
5149
chown root:0 /usr/local/bin/cosign-darwin-amd64.gz && chmod g+wx /usr/local/bin/cosign-darwin-amd64.gz && \
5250
chown root:0 /usr/local/bin/cosign-darwin-arm64.gz && chmod g+wx /usr/local/bin/cosign-darwin-arm64.gz && \
53-
chown root:0 /usr/local/bin/cosign-windows-amd64.exe.gz && chmod g+wx /usr/local/bin/cosign-windows-amd64.exe.gz && \
54-
chown root:0 /usr/local/bin/cosign-linux-arm64.gz && chmod g+wx /usr/local/bin/cosign-linux-arm64.gz && \
55-
chown root:0 /usr/local/bin/cosign-linux-amd64.gz && chmod g+wx /usr/local/bin/cosign-linux-amd64.gz && \
56-
chown root:0 /usr/local/bin/cosign-linux-ppc64le.gz && chmod g+wx /usr/local/bin/cosign-linux-ppc64le.gz && \
57-
chown root:0 /usr/local/bin/cosign-linux-s390x.gz && chmod g+wx /usr/local/bin/cosign-linux-s390x.gz
51+
chown root:0 /usr/local/bin/cosign-windows-amd64.exe.gz && chmod g+wx /usr/local/bin/cosign-windows-amd64.exe.gz
5852

59-
##Configure home directory
53+
# Configure home directory
6054
ENV HOME=/home
6155
RUN chgrp -R 0 /${HOME} && chmod -R g=u /${HOME}
6256

0 commit comments

Comments
 (0)