[8.x](backport #7690) Fips packaging

.buildkite/integration.pipeline.yml

@@ -118,6 +118,36 @@ steps:
           imagePrefix: "core-ubuntu-2204-aarch64"
           diskSizeGb: 200
 
+      - label: "Packaging: Containers linux/amd64 FIPS"
+        key: packaging-containers-x86-64-fips
+        env:
+          PACKAGES: "docker"
+          PLATFORMS: "linux/amd64"
+          FIPS: "true"
+        command: ".buildkite/scripts/steps/integration-package.sh"
+        artifact_paths:
+          - build/distributions/**
+        agents:
+          provider: "gcp"
+          machineType: "n2-standard-8"
+          diskSizeGb: 200
+
+      - label: "Packaging: Containers linux/arm64 FIPS"
+        key: packaging-containers-arm64-fips
+        env:
+          PACKAGES: "docker"
+          PLATFORMS: "linux/arm64"
+          FIPS: "true"
+        command: |
+          .buildkite/scripts/steps/integration-package.sh
+        artifact_paths:
+          - build/distributions/**
+        agents:
+          provider: "aws"
+          instanceType: "c6g.4xlarge"
+          imagePrefix: "core-ubuntu-2204-aarch64"
+          diskSizeGb: 200
+
   - label: "Serverless integration test"
     key: "serverless-integration-tests"
     depends_on:

.buildkite/pipeline.elastic-agent-binary-dra.yml

@@ -25,7 +25,21 @@ steps:
       env:
         DRA_WORKFLOW: "snapshot"
         PLATFORMS: "linux/amd64 windows/amd64 darwin/amd64"
-
+
+    - label: ":package: linux/amd64 FIPS Elastic-Agent Core Snapshot"
+      commands:
+        - .buildkite/scripts/steps/build-agent-core.sh
+      key: "build-dra-snapshot-x86-fips"
+      artifact_paths:
+        - "build/distributions/**/*"
+      agents:
+        provider: "gcp"
+        machineType: "c2-standard-16"
+      env:
+        DRA_WORKFLOW: "snapshot"
+        PLATFORMS: "linux/amd64"
+        FIPS: "true"
+
     - label: ":package: linux/arm64 darwin/arm64 Elastic-Agent Core Snapshot"
       commands:
         - .buildkite/scripts/steps/build-agent-core.sh
@@ -40,6 +54,20 @@ steps:
         DRA_WORKFLOW: "snapshot"
         PLATFORMS: "linux/arm64 darwin/arm64"
 
+    - label: ":package: linux/arm64 FIPS Elastic-Agent Core Snapshot"
+      commands:
+        - .buildkite/scripts/steps/build-agent-core.sh
+      key: "build-dra-snapshot-arm-fips"
+      artifact_paths:
+        - "build/distributions/**/*"
+      agents:
+        provider: "aws"
+        instanceType: "c6g.4xlarge"
+        imagePrefix: "core-ubuntu-2204-aarch64"
+      env:
+        DRA_WORKFLOW: "snapshot"
+        PLATFORMS: "linux/arm64"
+        FIPS: "true"
     - wait
 
     - label: ":hammer: DRA Publish Elastic-Agent Core Snapshot"
@@ -86,6 +114,21 @@ steps:
         DRA_WORKFLOW: "staging"
         PLATFORMS: "linux/amd64 windows/amd64 darwin/amd64"
 
+    - label: ":package: linux/amd64 FIPS Elastic-Agent Core staging"
+      commands: |
+        source .buildkite/scripts/version_qualifier.sh
+        .buildkite/scripts/steps/build-agent-core.sh
+      key: "build-dra-staging-x86-fips"
+      artifact_paths:
+        - "build/distributions/**/*"
+      agents:
+        provider: "gcp"
+        machineType: "c2-standard-16"
+      env:
+        DRA_WORKFLOW: "staging"
+        PLATFORMS: "linux/amd64"
+        FIPS: "true"
+
     - label: ":package: linux/arm64 darwin/arm64 Elastic-Agent Core staging"
       commands: |
         source .buildkite/scripts/version_qualifier.sh
@@ -101,6 +144,22 @@ steps:
         DRA_WORKFLOW: "dra-core-staging"
         PLATFORMS: "linux/arm64 darwin/arm64"
 
+    - label: ":package: linux/arm64 FIPS Elastic-Agent Core staging"
+      commands: |
+        source .buildkite/scripts/version_qualifier.sh
+        .buildkite/scripts/steps/build-agent-core.sh
+      key: "build-dra-staging-arm-fips"
+      artifact_paths:
+        - "build/distributions/**/*"
+      agents:
+        provider: "aws"
+        instanceType: "c6g.4xlarge"
+        imagePrefix: "core-ubuntu-2204-aarch64"
+      env:
+        DRA_WORKFLOW: "dra-core-staging"
+        PLATFORMS: "linux/arm64"
+        FIPS: "true"
+
     - wait
 
     - label: ":hammer: DRA Publish Elastic-Agent Core staging"

dev-tools/mage/build.go

@@ -18,6 +18,8 @@ import (
 	"github.com/magefile/mage/sh"
 	"golang.org/x/text/cases"
 	"golang.org/x/text/language"
+
+	"github.com/elastic/elastic-agent/dev-tools/packaging"
 )
 
 // BuildArgs are the arguments used for the "build" target and they define how
@@ -73,6 +75,7 @@ func DefaultBuildArgs() BuildArgs {
 	args := BuildArgs{
 		Name: BeatName,
 		CGO:  build.Default.CgoEnabled,
+		Env:  map[string]string{},
 		Vars: map[string]string{
 			elasticAgentModulePath + "/version.buildTime": "{{ date }}",
 			elasticAgentModulePath + "/version.commit":    "{{ commit }}",
@@ -88,8 +91,16 @@ func DefaultBuildArgs() BuildArgs {
 	}
 
 	if FIPSBuild {
-		args.ExtraFlags = append(args.ExtraFlags, "-tags=requirefips")
-		args.CGO = true
+
+		fipsConfig := packaging.Settings().FIPS
+
+		for _, tag := range fipsConfig.Compile.Tags {
+			args.ExtraFlags = append(args.ExtraFlags, "-tags="+tag)
+		}
+		args.CGO = args.CGO || fipsConfig.Compile.CGO
+		for varName, value := range fipsConfig.Compile.Env {
+			args.Env[varName] = value
+		}
 	}
 
 	if DevBuild {
@@ -191,11 +202,6 @@ func Build(params BuildArgs) error {
 		cgoEnabled = "1"
 	}
 
-	if FIPSBuild {
-		cgoEnabled = "1"
-		env["GOEXPERIMENT"] = "systemcrypto"
-	}
-
 	env["CGO_ENABLED"] = cgoEnabled
 
 	// Spec