Enable FIPS without openssl - #994
Conversation
e0b8b58 to
5a54ae9
Compare
| WORKDIR /opt/app-root/src/redhat-opentelemetry-collector | ||
|
|
||
| RUN CGO_ENABLED=1 GOEXPERIMENT=strictfipsruntime go build -C ./_build -mod=mod -tags strictfipsruntime -o opentelemetry-collector -trimpath -ldflags "-w" | ||
| # TODO: bump GOFIPS140 to v1.26.0 once its FIPS 140 validation is completed |
There was a problem hiding this comment.
Thoughts on GOFIPS140=certified? It would bump automatically, TBD if that happens on a Go z-stream update or only on a y-stream update. What do you think about either of those possibilities? Seems reasonable if the module shifts on a y-stream update but it's not clear to me or the team if they'll bump this on z-stream updates possibly too which would represent a new module coming in with little oversight, though we could certainly test it in advance.
From https://go.dev/doc/security/fips140#the-gofips140-environment-variable
inprocess and certified are equivalent to specifying the latest version that reached the CMVP Modules In Process List and the latest version that obtained a CMVP validation certificate, respectively.
There was a problem hiding this comment.
certified option seems good from my standpoint. I am not sure how/what (if anything) we should test if the value changes.
This is the test PR job https://github.com/openshift/release/pull/83623/changes#diff-b6a44cc6ee1122b3774ae13d32fbb79f35c12c6dc0cd35463404eaab02dcbc67R63 . It uses tls-scanner with PQC_CHECK: "true"
| WORKDIR /opt/app-root/src/redhat-opentelemetry-collector | ||
|
|
||
| RUN CGO_ENABLED=1 GOEXPERIMENT=strictfipsruntime go build -C ./_build -mod=mod -tags strictfipsruntime -o opentelemetry-collector -trimpath -ldflags "-w" | ||
| RUN CGO_ENABLED=0 GOFIPS140=certified go build -C ./_build -mod=mod -tags no_openssl -o opentelemetry-collector -trimpath -ldflags "-w" |
There was a problem hiding this comment.
Using CGO_ENABLED=0 avoids using glibc, and iirc there might be subtle and exotic differences around DNS, IPv6 and /etc/hosts. Not sure if it's an issue in practice though (not a blocker from my side)
Signed-off-by: Pavol Loffay <p.loffay@gmail.com>
a894ded to
c9e1a00
Compare
4 participants
Test PR: openshift/release#83623
Switch from openssl-based FIPS (
CGO_ENABLED=1 GOEXPERIMENT=strictfipsruntime) to Go's native FIPS 140 module (GOFIPS140=v1.0.0). This removes the openssl RPM dependency and produces static binaries (CGO_ENABLED=0).Build-time:
GOFIPS140=v1.0.0A build-time variable that tells the Go compiler which FIPS 140 crypto module to embed into the binary. Two modules are available:
v1.0.0v1.26.0We use
v1.0.0because its FIPS 140 validation is already completed. Both modules support ML-KEM (post-quantum key encapsulation), so PQC key exchange is available withv1.0.0.Runtime:
GODEBUG=fips140=autoTells the Go runtime to automatically enable its native FIPS 140 crypto module when the host OS is in FIPS mode (
/proc/sys/crypto/fips_enabledis1). If the host is not in FIPS mode, the binary runs with standard crypto.fips140=autofips140=onfips140=onlyOther changes
-tags no_openssldisables the openssl Go moduleopensslRPM from all images (operator, targetallocator, collector)install-additional-packagesstageRPM diff: shipped image vs this PR
Comparison of
registry.redhat.io/rhosdt/opentelemetry-rhel9-operator:rhosdt-3.10.2(shipped) vsdocker.io/pavolloffay/otel-operator:1787078996(this PR).The PR image is a strict subset — no new RPMs added. 17 RPMs removed:
RPMs installed after this change
All RPMs from
ubi-microbase image (20 RPMs):