Skip to content

Commit 1854f18

Browse files
nr-dadamsalvarocabanasrajrohanyadav
authored
Adding fips compliant agents to Prerelease on demand workflow (#1942)
* Feat: Adding Fips compliant Infrastructure agents to prerelease build pipeline. * Ubuntu16 Builder Dockerfile. * Adding 'FIPS, NON-FIPS and ALL' as a workflow field option for prerelease on demand. * New signing scripts to overcome the lack of support for Passphrase pinned. * Edited binary names, and fips variable in linux on demand workflow * Added fips parameter to the package_name as needed for metadata * Update goreleaser version (#1960) * Add step to test fips binaries for fips compliance (#1963) --------- Co-authored-by: alvarocabanas <[email protected]> Co-authored-by: Rohan Yadav <[email protected]>
1 parent fec6b82 commit 1854f18

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

74 files changed

+1524
-510
lines changed

‎.github/workflows/component_linux_build.yml

+4
Original file line numberDiff line numberDiff line change
@@ -28,3 +28,7 @@ jobs:
2828
password: ${{ secrets.DOCKER_HUB_PASSWORD }}
2929
- name: Build all platforms:arch
3030
run: make ci/build
31+
- name: Test FIPS binaries for fips compliance
32+
uses: newrelic/coreint-automation/test-fips-action@v3
33+
with:
34+
binaries_path: "./dist"

‎.github/workflows/prerelease_linux_on_demand.yml

+107-4
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,10 @@ on:
1212
dest_prefix:
1313
description: 'Repo prefix'
1414
required: true
15+
BUILD_MODE:
16+
description: 'Enable NON-FIPS, FIPS or ALL'
17+
required: false
18+
default: 'NON-FIPS' # "ALL" "NON-FIPS" "FIPS":
1519

1620
env:
1721
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
@@ -55,7 +59,8 @@ jobs:
5559
username: ${{ env.DOCKER_HUB_ID }}
5660
password: ${{ env.DOCKER_HUB_PASSWORD }}
5761

58-
- name: Preparing all linux packages
62+
- name: Preparing all NON-FIPS linux packages
63+
if: ${{ inputs.BUILD_MODE == 'ALL' || inputs.BUILD_MODE == 'NON-FIPS' }}
5964
run: make ci/prerelease/linux
6065
env:
6166
TAG: ${{ env.FAKE_TAG }}
@@ -67,7 +72,8 @@ jobs:
6772
files_path: 'dist'
6873
run_sudo: true
6974

70-
- name: Publish deb to S3 action
75+
- name: Publish NON-FIPS deb to S3 action
76+
if: ${{ inputs.BUILD_MODE == 'ALL' || inputs.BUILD_MODE == 'NON-FIPS' }}
7177
uses: newrelic/[email protected]
7278
with:
7379
tag: ${{env.FAKE_TAG}}
@@ -92,7 +98,8 @@ jobs:
9298
local_packages_path: "/srv/dist/"
9399
apt_skip_mirror: true
94100

95-
- name: Publish rpm to S3 action
101+
- name: Publish NON-FIPS rpm to S3 action
102+
if: ${{ inputs.BUILD_MODE == 'ALL' || inputs.BUILD_MODE == 'NON-FIPS' }}
96103
uses: newrelic/[email protected]
97104
with:
98105
tag: ${{env.FAKE_TAG}}
@@ -116,7 +123,8 @@ jobs:
116123
dest_prefix: ${{ env.DEST_PREFIX }}
117124
local_packages_path: "/srv/dist/"
118125

119-
- name: Publish targz to S3 action
126+
- name: Publish NON-FIPS targz to S3 action
127+
if: ${{ inputs.BUILD_MODE == 'ALL' || inputs.BUILD_MODE == 'NON-FIPS' }}
120128
uses: newrelic/[email protected]
121129
with:
122130
tag: ${{env.FAKE_TAG}}
@@ -139,3 +147,98 @@ jobs:
139147
disable_lock: ${{ env.DISABLE_LOCK }}
140148
dest_prefix: ${{ env.DEST_PREFIX }}
141149
local_packages_path: "/srv/dist/"
150+
151+
- name: Preparing all FIPS linux packages
152+
if: ${{ inputs.BUILD_MODE == 'ALL' || inputs.BUILD_MODE == 'FIPS' }}
153+
run: make ci/prerelease/linux-fips
154+
env:
155+
TAG: ${{ env.FAKE_TAG }}
156+
FIPS: "-fips"
157+
- name: Test FIPS binaries for fips compliance
158+
if: ${{ inputs.BUILD_MODE == 'ALL' || inputs.BUILD_MODE == 'FIPS' }}
159+
uses: newrelic/coreint-automation/test-fips-action@v3
160+
with:
161+
binaries_path: "./dist"
162+
163+
- name: Generate checksum files
164+
uses: ./.github/actions/generate-checksums
165+
with:
166+
files_regex: '.*\(tar.gz\|deb\|rpm\)'
167+
files_path: 'dist'
168+
run_sudo: true
169+
170+
- name: Publish FIPS deb to S3 action
171+
if: ${{ inputs.BUILD_MODE == 'ALL' || inputs.BUILD_MODE == 'FIPS' }}
172+
uses: newrelic/[email protected]
173+
with:
174+
tag: ${{env.FAKE_TAG}}
175+
app_name: "newrelic-infra-fips"
176+
repo_name: "newrelic/infrastructure-agent"
177+
schema: "custom"
178+
schema_url: "https://raw.githubusercontent.com/newrelic/infrastructure-agent/${{ env.BRANCH }}/build/upload-schema-linux-deb-fips.yml"
179+
aws_access_key_id: ${{ env.AWS_ACCESS_KEY_ID }}
180+
aws_secret_access_key: ${{ env.AWS_SECRET_ACCESS_KEY }}
181+
aws_s3_bucket_name: ${{ env.AWS_S3_BUCKET_NAME }}
182+
aws_s3_lock_bucket_name: ${{ env.AWS_S3_LOCK_BUCKET_NAME }}
183+
access_point_host: ${{ env.ACCESS_POINT_HOST }}
184+
run_id: ${{ env.RUN_ID }}
185+
aws_region: ${{ env.AWS_REGION }}
186+
aws_role_session_name: ${{ env.AWS_ROLE_SESSION_NAME }}
187+
aws_role_arn: ${{ env.AWS_ROLE_ARN }}
188+
# used for signing package stuff
189+
gpg_passphrase: ${{ env.GPG_PASSPHRASE }}
190+
gpg_private_key_base64: ${{ env.GPG_PRIVATE_KEY_BASE64 }}
191+
disable_lock: ${{ env.DISABLE_LOCK }}
192+
dest_prefix: ${{ env.DEST_PREFIX }}
193+
local_packages_path: "/srv/dist/"
194+
apt_skip_mirror: true
195+
196+
- name: Publish FIPS rpm to S3 action
197+
if: ${{ inputs.BUILD_MODE == 'ALL' || inputs.BUILD_MODE == 'FIPS' }}
198+
uses: newrelic/[email protected]
199+
with:
200+
tag: ${{env.FAKE_TAG}}
201+
app_name: "newrelic-infra-fips"
202+
repo_name: "newrelic/infrastructure-agent"
203+
schema: "custom"
204+
schema_url: "https://raw.githubusercontent.com/newrelic/infrastructure-agent/${{ env.BRANCH }}/build/upload-schema-linux-rpm-fips.yml"
205+
aws_access_key_id: ${{ env.AWS_ACCESS_KEY_ID }}
206+
aws_secret_access_key: ${{ env.AWS_SECRET_ACCESS_KEY }}
207+
aws_s3_bucket_name: ${{ env.AWS_S3_BUCKET_NAME }}
208+
aws_s3_lock_bucket_name: ${{ env.AWS_S3_LOCK_BUCKET_NAME }}
209+
access_point_host: ${{ env.ACCESS_POINT_HOST }}
210+
run_id: ${{ env.RUN_ID }}
211+
aws_region: ${{ env.AWS_REGION }}
212+
aws_role_session_name: ${{ env.AWS_ROLE_SESSION_NAME }}
213+
aws_role_arn: ${{ env.AWS_ROLE_ARN }}
214+
# used for signing package stuff
215+
gpg_passphrase: ${{ env.GPG_PASSPHRASE }}
216+
gpg_private_key_base64: ${{ env.GPG_PRIVATE_KEY_BASE64 }}
217+
disable_lock: ${{ env.DISABLE_LOCK }}
218+
dest_prefix: ${{ env.DEST_PREFIX }}
219+
local_packages_path: "/srv/dist/"
220+
221+
- name: Publish FIPS targz to S3 action
222+
if: ${{ inputs.BUILD_MODE == 'ALL' || inputs.BUILD_MODE == 'FIPS' }}
223+
uses: newrelic/[email protected]
224+
with:
225+
tag: ${{env.FAKE_TAG}}
226+
app_name: "newrelic-infra-fips"
227+
repo_name: "newrelic/infrastructure-agent"
228+
schema: "custom"
229+
schema_url: "https://raw.githubusercontent.com/newrelic/infrastructure-agent/${{ env.BRANCH }}/build/upload-schema-linux-targz-fips.yml"
230+
aws_access_key_id: ${{ env.AWS_ACCESS_KEY_ID }}
231+
aws_secret_access_key: ${{ env.AWS_SECRET_ACCESS_KEY }}
232+
aws_s3_bucket_name: ${{ env.AWS_S3_BUCKET_NAME }}
233+
aws_s3_lock_bucket_name: ${{ env.AWS_S3_LOCK_BUCKET_NAME }}
234+
access_point_host: ${{ env.ACCESS_POINT_HOST }}
235+
run_id: ${{ env.RUN_ID }}
236+
aws_region: ${{ env.AWS_REGION }}
237+
aws_role_session_name: ${{ env.AWS_ROLE_SESSION_NAME }}
238+
aws_role_arn: ${{ env.AWS_ROLE_ARN }}
239+
# used for signing package stuff
240+
gpg_passphrase: ${{ env.GPG_PASSPHRASE }}
241+
gpg_private_key_base64: ${{ env.GPG_PRIVATE_KEY_BASE64 }}
242+
disable_lock: ${{ env.DISABLE_LOCK }}
243+
dest_prefix: ${{ env.DEST_PREFIX }}
244+
local_packages_path: "/srv/dist/"

‎build/.goreleaser_macos.yml

+2-1
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,8 @@
1+
version: 2
12
project_name: infrastructure-agent
23

34
snapshot:
4-
name_template: 0.0.0
5+
version_template: 0.0.0
56

67
builds:
78
- id: darwin-newrelic-infra

‎build/Dockerfile

+46-11
Original file line numberDiff line numberDiff line change
@@ -1,19 +1,54 @@
1-
FROM golang:1.22-bullseye
1+
# Use Ubuntu 16.04 as the base image
2+
FROM ubuntu:16.04
23

4+
# Define Go version
5+
ARG GO_VERSION=1.22.10
6+
# Define build-time arguments for the GitHub CLI version and architecture
37
ARG GH_VERSION='2.0.0'
48
ARG GH_ARCH='amd64'
59

6-
RUN apt-get update \
7-
&& apt-get -y install \
8-
rpm \
9-
gnupg2 \
10-
gpg-agent \
11-
debsigs \
12-
unzip \
13-
zip
1410

15-
RUN curl -L https://github.com/cli/cli/releases/download/v${GH_VERSION}/gh_${GH_VERSION}_linux_${GH_ARCH}.deb -o gh_${GH_VERSION}_linux_${GH_ARCH}.deb
16-
RUN dpkg -i gh_${GH_VERSION}_linux_${GH_ARCH}.deb
11+
# Install dependencies
12+
RUN apt-get update && apt-get install -y \
13+
curl \
14+
wget \
15+
expect \
16+
git \
17+
tar \
18+
gcc \
19+
g++ \
20+
gnupg2 \
21+
gnupg-agent \
22+
debsigs \
23+
rpm \
24+
build-essential \
25+
software-properties-common \
26+
python-software-properties \
27+
gcc-arm-linux-gnueabi \
28+
dpkg-sig \
29+
gcc-aarch64-linux-gnu
1730

31+
32+
# # Manually install cross-compilers
33+
# RUN apt-get install -y \
34+
# gcc-5-multilib-mips-linux-gnu
35+
36+
# Install Go 1.22.0
37+
RUN curl -sSL https://golang.org/dl/go${GO_VERSION}.linux-amd64.tar.gz -o go${GO_VERSION}.linux-amd64.tar.gz && \
38+
tar -C /usr/local -xzf go${GO_VERSION}.linux-amd64.tar.gz && \
39+
rm go${GO_VERSION}.linux-amd64.tar.gz
40+
41+
# Set Go environment variables
42+
ENV PATH="/usr/local/go/bin:/go/bin:${PATH}"
43+
ENV GOPATH="/go"
44+
45+
# Download and install the GitHub CLI
46+
RUN curl -L https://github.com/cli/cli/releases/download/v${GH_VERSION}/gh_${GH_VERSION}_linux_${GH_ARCH}.deb -o gh_${GH_VERSION}_linux_${GH_ARCH}.deb && \
47+
dpkg -i gh_${GH_VERSION}_linux_${GH_ARCH}.deb && \
48+
rm gh_${GH_VERSION}_linux_${GH_ARCH}.deb
49+
50+
# Optional: Set Go environment flags
1851
ENV GOFLAGS="-buildvcs=false"
52+
53+
# Optional: Configure git
1954
RUN git config --global --add safe.directory /go/src/github.com/newrelic/infrastructure-agent

‎build/ci.mk

+6-1
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,5 @@
11
BUILDER_IMG_TAG = infrastructure-agent-builder
2+
FIPS?=
23

34
.PHONY: ci/deps
45
ci/deps:GH_ARCH ?= amd64
@@ -59,6 +60,10 @@ ci/tools-test: ci/deps
5960
ci/prerelease/linux:
6061
TARGET_OS=linux $(MAKE) ci/prerelease
6162

63+
.PHONY : ci/prerelease/linux-fips
64+
ci/prerelease/linux-fips:
65+
TARGET_OS=linux-fips $(MAKE) ci/prerelease
66+
6267
.PHONY : ci/prerelease/linux-amd64
6368
ci/prerelease/linux-amd64:
6469
TARGET_OS=linux-amd64 $(MAKE) ci/prerelease
@@ -105,8 +110,8 @@ ifdef TAG
105110
-e GPG_PASSPHRASE \
106111
-e GPG_PRIVATE_KEY_BASE64 \
107112
-e SNAPSHOT=false \
113+
-e FIPS=$(FIPS) \
108114
$(BUILDER_IMG_TAG) make release-${TARGET_OS}
109-
110115
else
111116
@echo "===> infrastructure-agent === [ci/prerelease/linux] TAG env variable expected to be set"
112117
exit 1

‎build/container/Makefile

+8
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,14 @@ ifeq ($(AGENT_ARCH), arm)
2323
AGENT_ARCH := $(AGENT_ARCH)_6
2424
endif
2525

26+
ifeq ($(AGENT_ARCH), arm64)
27+
AGENT_ARCH := $(AGENT_ARCH)_v8.0
28+
endif
29+
30+
ifeq ($(AGENT_ARCH), amd64)
31+
AGENT_ARCH := $(AGENT_ARCH)_v1
32+
endif
33+
2634
ifeq ($(DOCKER_PUBLISH), true)
2735
DOCKER_BUILDX_EXTRA_ARGS = --push
2836
DOCKER_BUILDX_ARGS += $(DOCKER_BUILDX_EXTRA_ARGS)

‎build/goreleaser/linux/al2023_amd64.yml

+21-11
Original file line numberDiff line numberDiff line change
@@ -5,8 +5,14 @@
55
- linux-agent-amd64
66
- linux-ctl-amd64
77
- linux-service-amd64
8-
package_name: newrelic-infra
9-
file_name_template: "newrelic-infra-{{ .Env.TAG }}-1.amazonlinux-2023.{{ .Arch }}"
8+
package_name: "newrelic-infra{{ .Env.FIPS }}"
9+
file_name_template: >-
10+
newrelic-infra{{ .Env.FIPS }}-
11+
{{- .Env.TAG }}-1.amazonlinux-2023.
12+
{{- if eq .Arch "amd64" -}}x86_64
13+
{{- else -}}
14+
{{ .Arch }}
15+
{{- end }}
1016
vendor: 'New Relic, Inc.'
1117
homepage: 'https://docs.newrelic.com/docs/release-notes/infrastructure-release-notes/infrastructure-agent-release-notes'
1218
maintainer: '[email protected]'
@@ -44,17 +50,21 @@
4450
dst: '/var/db/newrelic-infra/newrelic-integrations/logging/out_newrelic.so'
4551
- src: 'assets/examples/logging/parsers.conf'
4652
dst: '/var/db/newrelic-infra/newrelic-integrations/logging/parsers.conf'
47-
empty_folders:
48-
- /opt/newrelic-infra/custom-integrations
49-
- /opt/newrelic-infra/newrelic-integrations
50-
- /var/db/newrelic-infra/custom-integrations
51-
- /var/db/newrelic-infra/integrations.d
52-
- /var/log/newrelic-infra
53-
- /var/run/newrelic-infra
53+
54+
- dst: /opt/newrelic-infra/custom-integrations
55+
type: dir
56+
- dst: /opt/newrelic-infra/newrelic-integrations
57+
type: dir
58+
- dst: /var/db/newrelic-infra/custom-integrations
59+
type: dir
60+
- dst: /var/db/newrelic-infra/integrations.d
61+
type: dir
62+
- dst: /var/log/newrelic-infra
63+
type: dir
64+
- dst: /var/run/newrelic-infra
65+
type: dir
5466
epoch: 0
5567
release: 1.amazonlinux-2023
56-
replacements:
57-
amd64: x86_64
5868

5969
# Scripts to execute during the installation of the package.
6070
scripts:

‎build/goreleaser/linux/al2023_arm.yml

+13-7
Original file line numberDiff line numberDiff line change
@@ -45,13 +45,19 @@
4545
# dst: '/var/db/newrelic-infra/newrelic-integrations/logging/out_newrelic.so'
4646
# - src: 'assets/examples/logging/parsers.conf'
4747
# dst: '/var/db/newrelic-infra/newrelic-integrations/logging/parsers.conf'
48-
empty_folders:
49-
- /opt/newrelic-infra/custom-integrations
50-
- /opt/newrelic-infra/newrelic-integrations
51-
- /var/db/newrelic-infra/custom-integrations
52-
- /var/db/newrelic-infra/integrations.d
53-
- /var/log/newrelic-infra
54-
- /var/run/newrelic-infra
48+
49+
- dst: /opt/newrelic-infra/custom-integrations
50+
type: dir
51+
- dst: /opt/newrelic-infra/newrelic-integrations
52+
type: dir
53+
- dst: /var/db/newrelic-infra/custom-integrations
54+
type: dir
55+
- dst: /var/db/newrelic-infra/integrations.d
56+
type: dir
57+
- dst: /var/log/newrelic-infra
58+
type: dir
59+
- dst: /var/run/newrelic-infra
60+
type: dir
5561
epoch: 0
5662
release: 1.amazonlinux-2023
5763

‎build/goreleaser/linux/al2023_arm64.yml

+15-9
Original file line numberDiff line numberDiff line change
@@ -5,8 +5,8 @@
55
- linux-agent-arm64
66
- linux-ctl-arm64
77
- linux-service-arm64
8-
package_name: newrelic-infra
9-
file_name_template: "newrelic-infra-{{ .Env.TAG }}-1.amazonlinux-2023.{{ .Arch }}"
8+
package_name: "newrelic-infra{{ .Env.FIPS }}"
9+
file_name_template: "newrelic-infra{{ .Env.FIPS }}-{{ .Env.TAG }}-1.amazonlinux-2023.{{ .Arch }}"
1010
vendor: 'New Relic, Inc.'
1111
homepage: 'https://docs.newrelic.com/docs/release-notes/infrastructure-release-notes/infrastructure-agent-release-notes'
1212
maintainer: '[email protected]'
@@ -44,13 +44,19 @@
4444
dst: '/var/db/newrelic-infra/newrelic-integrations/logging/out_newrelic.so'
4545
- src: 'assets/examples/logging/parsers.conf'
4646
dst: '/var/db/newrelic-infra/newrelic-integrations/logging/parsers.conf'
47-
empty_folders:
48-
- /opt/newrelic-infra/custom-integrations
49-
- /opt/newrelic-infra/newrelic-integrations
50-
- /var/db/newrelic-infra/custom-integrations
51-
- /var/db/newrelic-infra/integrations.d
52-
- /var/log/newrelic-infra
53-
- /var/run/newrelic-infra
47+
48+
- dst: /opt/newrelic-infra/custom-integrations
49+
type: dir
50+
- dst: /opt/newrelic-infra/newrelic-integrations
51+
type: dir
52+
- dst: /var/db/newrelic-infra/custom-integrations
53+
type: dir
54+
- dst: /var/db/newrelic-infra/integrations.d
55+
type: dir
56+
- dst: /var/log/newrelic-infra
57+
type: dir
58+
- dst: /var/run/newrelic-infra
59+
type: dir
5460
epoch: 0
5561
release: 1.amazonlinux-2023
5662

0 commit comments

Comments
 (0)