mirrors/pinniped
1
0
Fork 0
mirror of https://github.com/vmware-tanzu/pinniped.git synced 2026-09-20 15:04:34 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

CI changes for testing GOFIPS140 builds in PR pipeline

Browse Source 
Signed-off-by: Ryan Richard <richardry@vmware.com>
This commit is contained in:
Ryan Richard
2026-07-06 10:32:31 -07:00
parent 82cb634931
commit d9d65c97af
6 changed files with 298 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pipelines/shared-tasks/confirm-built-with-gofips140/task.sh
Executable
+53
View File
@@ -0,0 +1,53 @@
#!/usr/bin/env bash
# Copyright 2026 the Pinniped contributors. All Rights Reserved.
# SPDX-License-Identifier: Apache-2.0
set -euo pipefail
# Checking whether a binary was built with GOFIPS140.
#
# Example:
#
# go version -m ./pinniped | grep 'GOFIPS140=v'
# build GOFIPS140=v1.0.0-c2097c7c
#
# go version -m ./pinniped | grep 'DefaultGODEBUG=fips140=on'
# build DefaultGODEBUG=fips140=on
# Check whether the pinniped-server binary was built with GOFIPS140.
# Look for where GOFIPS140 starts with "v" because it can also equal "off", which we don't want.
if ! go version -m './image/rootfs/usr/local/bin/pinniped-server' | grep -q 'GOFIPS140=v'; then
echo "Pinniped server binary wasn't built with GOFIPS140 enabled (no GOFIPS140=v)."
exit 1
fi
if ! go version -m './image/rootfs/usr/local/bin/pinniped-server' | grep -q 'DefaultGODEBUG=fips140=on'; then
echo "Pinniped server binary wasn't built with GOFIPS140 enabled (no DefaultGODEBUG=fips140=on)."
exit 1
fi
# Check the same for the kube-cert-agent binary.
if ! go version -m './image/rootfs/usr/local/bin/pinniped-concierge-kube-cert-agent' | grep -q 'GOFIPS140=v'; then
echo "pinniped-concierge-kube-cert-agent binary wasn't built with GOFIPS140 enabled (no GOFIPS140=v)."
exit 1
fi
if ! go version -m './image/rootfs/usr/local/bin/pinniped-concierge-kube-cert-agent' | grep -q 'DefaultGODEBUG=fips140=on'; then
echo "pinniped-concierge-kube-cert-agent binary wasn't built with GOFIPS140 enabled (no DefaultGODEBUG=fips140=on)."
exit 1
fi
# Check the ldd output to see whether we compiled a static executable or not.
pinniped_server_ldd="$(ldd './image/rootfs/usr/local/bin/pinniped-server' 2>&1)"
# If it doesn't contain this line, that means the executable was dynamic, which we don't want.
if [[ "$pinniped_server_ldd" != *"not a dynamic executable"* ]]; then
echo "pinniped server binary is a dynamic executable."
exit 1
fi
# Check the ldd output to see whether we compiled a static executable or not.
kube_cert_agent_ldd="$(ldd './image/rootfs/usr/local/bin/pinniped-concierge-kube-cert-agent' 2>&1)"
# If it doesn't contain this line, that means the executable was dynamic, which we don't want.
if [[ "$kube_cert_agent_ldd" != *"not a dynamic executable"* ]]; then
echo "kube cert agent binary is a dynamic executable."
exit 1
fi
pipelines/shared-tasks/confirm-built-with-gofips140/task.yml
+15
View File
@@ -0,0 +1,15 @@
# Copyright 2026 the Pinniped contributors. All Rights Reserved.
# SPDX-License-Identifier: Apache-2.0
---
platform: linux
inputs:
- name: image
- name: pinniped-ci
image_resource:
type: registry-image
source:
repository: golang
tag: '1.26.4'
run:
path: pinniped-ci/pipelines/shared-tasks/confirm-built-with-gofips140/task.sh
pipelines/shared-tasks/deploy-to-integration/task.yml
+4 -1
View File
@@ -1,4 +1,4 @@
# Copyright 2020-2025 the Pinniped contributors. All Rights Reserved.
# Copyright 2020-2026 the Pinniped contributors. All Rights Reserved.
# SPDX-License-Identifier: Apache-2.0
---
@@ -33,6 +33,9 @@ params:
# only needed for unusual case of wanting to test the HTTPS_PROXY settings
FIREWALL_IDPS:
# only used when testing GOFIPS140 builds
SUPERVISOR_AND_CONCIERGE_GODEBUG_FIPS140_ONLY:
# needed when we are testing against active directory.
TEST_ACTIVE_DIRECTORY:
AWS_AD_HOST: