MGMT-21756: enable FIPS 140-3 crypto module in Go builds #650
Conversation
Add GOFIPS140=latest to go build commands to enable Go 1.24+ native FIPS 140-3 cryptographic module. This ensures the application uses FIPS-validated crypto when deployed on FIPS-enabled clusters. See https://go.dev/doc/security/fips140
|
Pipeline controller notification For optional jobs, comment This repository is configured in: LGTM mode |
openshift-ci-robot
added
the
jira/valid-reference
|
@omer-vishlitzky: This pull request references MGMT-21756 which is a valid jira issue. Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the epic to target the "4.22.0" version, but no target version was set. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
@omer-vishlitzky: This pull request references MGMT-21756 which is a valid jira issue. Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the epic to target the "4.22.0" version, but no target version was set. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
openshift-ci
bot
added
the
size/XS
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: omer-vishlitzky The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
openshift-ci
bot
added
the
approved
|
@omer-vishlitzky: all tests passed! Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #650 +/- ##
=======================================
Coverage 59.02% 59.02%
=======================================
Files 27 27
Lines 1674 1674
=======================================
Hits 988 988
Misses 524 524
Partials 162 162 🚀 New features to boost your workflow:
|
|
/retest |
|
/hold |
openshift-ci
bot
added
the
do-not-merge/hold
| ADD . /app | ||
| WORKDIR /app | ||
| RUN CGO_ENABLED=1 GOFLAGS="" GO111MODULE=on go build -o /assisted-image-service main.go | ||
| RUN CGO_ENABLED=1 GOFIPS140=latest GOFLAGS="" GO111MODULE=on go build -o /assisted-image-service main.go |
There was a problem hiding this comment.
What's the difference between this and what we do for the mce-specific build?
RUN GO111MODULE=on GOOS=${TARGETOS} GOARCH=${TARGETARCH} go build -tags strictfipsruntime -o assisted-image-service main.go
Should we change both?
3 participants
Add GOFIPS140=latest to go build commands to enable Go 1.24+ native FIPS 140-3 cryptographic module. This ensures the application uses FIPS-validated crypto when deployed on FIPS-enabled clusters.
see here: https://go.dev/doc/security/fips140
https://issues.redhat.com/browse/MGMT-21756