Add fips check #466
Add fips check #466
Conversation
Reviewer's GuideAdds FIPS-aware build support and multi-platform OCI image builds by parameterizing FIPS in Go builds, simplifying Makefile cross-platform targets, and updating Tekton pipelines to pass new fips-check and build-platforms parameters while switching cosign pipelines to a multi-platform OCI TA pipeline definition. Sequence diagram for updated Tekton multi-platform FIPS build pipelinesequenceDiagram
actor Developer
participant GitProvider
participant TektonPipelineRun
participant DockerBuildMultiPlatformPipeline
participant GoBuildTask
Developer->>GitProvider: Open pull_request / push commit
GitProvider-->>TektonPipelineRun: Trigger cosign-pull-request or cosign-push
TektonPipelineRun->>DockerBuildMultiPlatformPipeline: Start pipeline
activate DockerBuildMultiPlatformPipeline
TektonPipelineRun->>DockerBuildMultiPlatformPipeline: Param build-platforms=[linux/x86_64, linux/arm64, linux/ppc64le, linux/s390x]
TektonPipelineRun->>DockerBuildMultiPlatformPipeline: Param fips-check=true
loop for each platform in build-platforms
DockerBuildMultiPlatformPipeline->>GoBuildTask: Run Go build for platform
activate GoBuildTask
GoBuildTask->>GoBuildTask: Set env GOFIPS140=FIPS_MODULE
GoBuildTask->>GoBuildTask: go build ./cmd/cosign with FIPS flags
GoBuildTask-->>DockerBuildMultiPlatformPipeline: Built cosign binary for platform
deactivate GoBuildTask
end
DockerBuildMultiPlatformPipeline-->>TektonPipelineRun: Multi-platform OCI image built (FIPS-aware)
deactivate DockerBuildMultiPlatformPipeline
TektonPipelineRun-->>GitProvider: Report CI status (includes fips-check results)
GitProvider-->>Developer: CI status on PR / branch
Flow diagram for build-platforms fan-out in Tekton pipelineflowchart TB
Start["Tekton pipeline start"] --> Params["Read parameters"]
Params --> BuildPlatforms["build-platforms list
- linux/x86_64
- linux/arm64
- linux/ppc64le
- linux/s390x"]
Params --> FIPSParam["fips-check=true"]
FIPSParam --> FIPSTask["Run FIPS check"]
BuildPlatforms --> FanOut{For each platform}
FanOut --> X86["Build for linux/x86_64"]
FanOut --> Arm64["Build for linux/arm64"]
FanOut --> Ppc64le["Build for linux/ppc64le"]
FanOut --> S390x["Build for linux/s390x"]
X86 --> Merge
Arm64 --> Merge
Ppc64le --> Merge
S390x --> Merge
FIPSTask --> Merge
Merge["Assemble multi-platform OCI image"] --> End["Publish image and report CI status"]
File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
JasonPowr
force-pushed
the
add-fips-check
branch
from
adc59ad to
638e6ca
Compare
|
/retest |
JasonPowr
force-pushed
the
add-fips-check
branch
from
638e6ca to
b4f143e
Compare
JasonPowr
force-pushed
the
add-fips-check
branch
2 times, most recently
from
c3bd73e to
3872532
Compare
|
/retest |
JasonPowr
force-pushed
the
add-fips-check
branch
from
3872532 to
9d0653c
Compare
JasonPowr
force-pushed
the
add-fips-check
branch
from
9d0653c to
581818d
Compare
|
You are nearing your monthly Qodo Merge usage quota. For more information, please visit here. PR Compliance Guide 🔍Below is a summary of compliance checks for this PR:
Compliance status legend🟢 - Fully Compliant🟡 - Partial Compliant 🔴 - Not Compliant ⚪ - Requires Further Human Verification 🏷️ - Compliance label |
||||||||||||||||||||||||||||
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
There was a problem hiding this comment.
Hey there - I've reviewed your changes - here's some feedback:
- The
build-platformsparameter values uselinux/x86_64, but most OCI/buildx tooling expectslinux/amd64; consider aligning the architecture strings to the standard values to avoid unexpected build failures. - By removing the Linux build targets from
cross-platformand the Makefile entirely, local Linux binaries are no longer easily buildable viamake; consider retaining simple Linux targets (or a wrapper target) to preserve existing developer workflows while still centralizing CI builds in Tekton.
Prompt for AI Agents
Please address the comments from this code review:
## Overall Comments
- The `build-platforms` parameter values use `linux/x86_64`, but most OCI/buildx tooling expects `linux/amd64`; consider aligning the architecture strings to the standard values to avoid unexpected build failures.
- By removing the Linux build targets from `cross-platform` and the Makefile entirely, local Linux binaries are no longer easily buildable via `make`; consider retaining simple Linux targets (or a wrapper target) to preserve existing developer workflows while still centralizing CI builds in Tekton.Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.
|
You are nearing your monthly Qodo Merge usage quota. For more information, please visit here. PR Code Suggestions ✨Explore these optional code suggestions:
|
||||||||||||||||||
2 participants
User description
Summary by Sourcery
Enable FIPS-aware builds and multi-platform CI pipelines for cosign artifacts.
Build:
CI:
PR Type
Enhancement, Other
Description
Add FIPS compliance support via parameterized GOFIPS140 in build targets
Enable multi-platform OCI builds in Tekton pipelines with fips-check parameter
Centralize Linux builds in Tekton, removing platform-specific Makefile targets
Simplify Dockerfile by consolidating Linux binary handling and removing redundant platform copies
Diagram Walkthrough
File Walkthrough
Build.mak
Parameterize FIPS and remove Linux build targetsBuild.mak
FIPS_MODULEvariable with default valuelatestfor FIPS-compliantbuilds
GOFIPS140=$(FIPS_MODULE)into all cross-platform build targetscentralize in Tekton
Dockerfile.cosign.rh
Simplify Docker build and remove Linux platform variantsDockerfile.cosign.rh
cosign-linuxbinary in build stage instead ofplatform-specific variants
binaries (arm64, ppc64le, s390x, amd64)
cosign.gz, Darwin, Windows variants)
client-server-pull-request.yaml
Enable FIPS check in client-server PR pipeline.tekton/client-server-pull-request.yaml
fips-checkparameter set totruefor FIPS validation in pullrequest pipeline
client-server-push.yaml
Enable FIPS check in client-server push pipeline.tekton/client-server-push.yaml
fips-checkparameter set totruefor FIPS validation in pushpipeline
cosign-pull-request.yaml
Add multi-platform builds and FIPS check to cosign PR.tekton/cosign-pull-request.yaml
build-platformsparameter with four Linux architectures (x86_64,arm64, ppc64le, s390x)
fips-checkparameter set totruefor FIPS validationdocker-build-oci-ta.yamltodocker-build-multi-platform-oci-ta.yamlcosign-push.yaml
Add multi-platform builds and FIPS check to cosign push.tekton/cosign-push.yaml
build-platformsparameter with four Linux architectures (x86_64,arm64, ppc64le, s390x)
fips-checkparameter set totruefor FIPS validationdocker-build-oci-ta.yamltodocker-build-multi-platform-oci-ta.yaml