Adding fips compliant agents to Prerelease on demand workflow #1942

nr-dadams · 2024-10-25T17:42:20Z

Adds build mode field for FIPS/Non FIPS
New dockerfile for fips compliant building
publishes fips compliant agents with '_fips' naming convention

https://new-relic.atlassian.net/browse/NR-268769

… pipeline

.github/workflows/prerelease_linux_on_demand.yml

gsanchezgavier · 2024-11-04T13:16:32Z

build/ci.mk

+			-v $(CURDIR):/go/src/github.com/newrelic/infrastructure-agent \
+            -w /go/src/github.com/newrelic/infrastructure-agent \


is it needed to place the code here? sounds like the old gopath dance

build/upload-schema-linux-deb-fips.yml

gsanchezgavier · 2024-11-04T13:31:24Z

cmd/newrelic-infra-ctl/newrelic-infra-ctl.go

 package main

 import (
 	"context"
 	"flag"
 	"fmt"
+	"github.com/newrelic/infrastructure-agent/pkg/ipc"


this change looks like a wrong ide config

gsanchezgavier · 2024-11-04T13:35:41Z

cmd/newrelic-infra-ctl/newrelic-infra-ctl-fips.go

+
+import (
+	"context"
+	_ "crypto/tls/fipsonly"


is this the only diff between the two files? did you consider to extract as much as possible from this file into a separate file inside the same package ? or couldn't this dep be added in another file with just the dependency ? The objective would be to avoid code duplication.

same comment would apply for the three binaries, i think the most important is the newrelic-infa.go

I mean having an extra file fips_deps.go with

//go:build fips package main import ( _ "crypto/tls/fipsonly" )

Would that work?

Thanks for the comment! I've updated the code and files to reflect this

cool, I'm happy it worked, ~1k lines less to maintain :)

nr-dadams · 2024-11-19T18:51:32Z

Had to make a few optimization changes after talking with @alvarocabanas , but this should be a bit cleaner and building/deploying successfully now. It is ready for another review as needed.

alvarocabanas

I left comments for the places we need to change the suffix.

alvarocabanas · 2024-11-21T13:31:47Z

build/goreleaser/linux/centos_7_amd64.yml

@@ -6,7 +6,7 @@
      - linux-ctl-amd64
      - linux-service-amd64
    package_name: newrelic-infra
-    file_name_template: "newrelic-infra-{{ .Env.TAG }}-1.el7.{{ .Arch }}"
+    file_name_template: "newrelic-infra-{{ .Env.TAG }}-1.el7.{{ .Arch }}{{ .Env.FIPS }}"


Based on the recommendation by a team member, we want to move the FIPS suffix and place it after the app name newrelic-infra-fips..., this is to follow the pattern packages normally follow, so this would be:

"newrelic-infra{{ .Env.FIPS }}-{{ .Env.TAG }}-1.el7.{{ .Arch }}"

alvarocabanas · 2024-11-21T13:32:45Z

build/goreleaser/linux/centos_7_arm.yml

@@ -6,7 +6,7 @@
      - linux-ctl-arm
      - linux-service-arm
    package_name: newrelic-infra
-    file_name_template: "newrelic-infra-{{ .Env.TAG }}-1.el7.{{ .Arch }}"
+    file_name_template: "newrelic-infra-{{ .Env.TAG }}-1.el7.{{ .Arch }}{{ .Env.FIPS }}"


Same, this should be :

"newrelic-infra{{ .Env.FIPS }}-{{ .Env.TAG }}-1.el7.{{ .Arch }}"

alvarocabanas · 2024-11-21T13:33:23Z

build/goreleaser/linux/centos_7_arm64.yml

@@ -6,7 +6,7 @@
      - linux-ctl-arm64
      - linux-service-arm64
    package_name: newrelic-infra
-    file_name_template: "newrelic-infra-{{ .Env.TAG }}-1.el7.{{ .Arch }}"
+    file_name_template: "newrelic-infra-{{ .Env.TAG }}-1.el7.{{ .Arch }}{{ .Env.FIPS }}"


Same, this should be :

"newrelic-infra{{ .Env.FIPS }}-{{ .Env.TAG }}-1.el7.{{ .Arch }}"

alvarocabanas · 2024-11-21T13:34:09Z

build/goreleaser/linux/centos_8_amd64.yml

@@ -6,7 +6,7 @@
      - linux-ctl-amd64
      - linux-service-amd64
    package_name: newrelic-infra
-    file_name_template: "newrelic-infra-{{ .Env.TAG }}-1.el8.{{ .Arch }}"
+    file_name_template: "newrelic-infra-{{ .Env.TAG }}-1.el8.{{ .Arch }}{{ .Env.FIPS }}"


Same, this should be :

"newrelic-infra{{ .Env.FIPS }}-{{ .Env.TAG }}-1.el8.{{ .Arch }}"

alvarocabanas · 2024-11-21T13:34:35Z

build/goreleaser/linux/centos_8_arm64.yml

@@ -6,7 +6,7 @@
      - linux-ctl-arm64
      - linux-service-arm64
    package_name: newrelic-infra
-    file_name_template: "newrelic-infra-{{ .Env.TAG }}-1.el8.{{ .Arch }}"
+    file_name_template: "newrelic-infra-{{ .Env.TAG }}-1.el8.{{ .Arch }}{{ .Env.FIPS }}"


Same, this should be :

"newrelic-infra{{ .Env.FIPS }}-{{ .Env.TAG }}-1.el8.{{ .Arch }}"

alvarocabanas · 2024-11-21T13:47:42Z

build/upload-schema-linux-rpm-fips.yml

+        - 15.4
+        - 15.5
+
+- src: "newrelic-infra-{version}-1.amazonlinux-{os_version}.{arch}_fips.rpm.sum"


alvarocabanas · 2024-11-21T13:47:49Z

build/upload-schema-linux-rpm-fips.yml

+        - 2
+        - 2023
+
+- src: "newrelic-infra-{version}-1.amazonlinux-{os_version}.{arch}_fips.rpm.sum"


alvarocabanas · 2024-11-21T13:49:39Z

build/upload-schema-linux-targz-fips.yml

@@ -0,0 +1,33 @@
+---
+- src: "newrelic-infra_linux_{version}_{arch}_fips.tar.gz"


alvarocabanas · 2024-11-21T13:49:44Z

build/upload-schema-linux-targz-fips.yml

+  # UPLOAD CHECKSUMS #
+#########################
+
+- src: "newrelic-infra_linux_{version}_{arch}_fips.tar.gz.sum"


alvarocabanas · 2024-11-21T13:49:55Z

build/upload-schema-linux-targz-fips.yml

+  # UPLOAD SIGNATURE #
+#########################
+
+- src: "newrelic-infra_linux_{version}_{arch}_fips.tar.gz.asc"


Feat: Adding Fips compliant Infrastructure agents to prerelease build…

92d1d10

… pipeline

nr-dadams requested a review from a team October 25, 2024 17:42

Merge branch 'master' into dadams_fips_prerelease

c5d03b1

gsanchezgavier reviewed Nov 4, 2024

View reviewed changes

Updating go version in fips dockerfile

2741880

gsanchezgavier mentioned this pull request Nov 6, 2024

NR-291019 add fips compliant package builds newrelic/nri-flex#530

Merged

nr-dadams and others added 6 commits November 8, 2024 09:50

Simplified pipeline. Removed docker.fips. Remove some unneeded comments.

6b4bc3e

Adding 'NON-FIPS' as a workflow field option

acef6d5

Removed faulty new lines

97e982c

Remove extraneous else

2595413

Chore: Back to 1.21

c305a0f

Editing everything to be one sign method

7cddd1e

nr-dadams requested a review from a team as a code owner November 14, 2024 00:00

nr-dadams added 4 commits November 13, 2024 16:10

Update go version

a481921

Attempt to fix dirty git

efc38f4

Removing file update to check if it is the cause of gits anger

ab53c09

Setting files as executable within git.. again

f273ce5

nr-dadams added 2 commits November 20, 2024 16:05

Removing auto IDE changes from files, adding changes requested by Alvaro

a7fc403

trying with different ifdef model

e55bf36

alvarocabanas reviewed Nov 21, 2024

View reviewed changes

alvarocabanas mentioned this pull request Nov 21, 2024

add fips upload schemas to ohi.yml newrelic/infrastructure-publish-action#163

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Adding fips compliant agents to Prerelease on demand workflow #1942

Adding fips compliant agents to Prerelease on demand workflow #1942

nr-dadams commented Oct 25, 2024 •

edited

Loading

gsanchezgavier Nov 4, 2024

gsanchezgavier Nov 4, 2024

gsanchezgavier Nov 4, 2024

gsanchezgavier Nov 4, 2024

gsanchezgavier Nov 4, 2024

nr-dadams Nov 8, 2024

gsanchezgavier Nov 18, 2024

nr-dadams commented Nov 19, 2024

alvarocabanas left a comment

alvarocabanas Nov 21, 2024

alvarocabanas Nov 21, 2024

alvarocabanas Nov 21, 2024

alvarocabanas Nov 21, 2024

alvarocabanas Nov 21, 2024

alvarocabanas Nov 21, 2024

alvarocabanas Nov 21, 2024

alvarocabanas Nov 21, 2024

alvarocabanas Nov 21, 2024

alvarocabanas Nov 21, 2024

		-v $(CURDIR):/go/src/github.com/newrelic/infrastructure-agent \
		-w /go/src/github.com/newrelic/infrastructure-agent \

		@@ -0,0 +1,33 @@
		---
		- src: "newrelic-infra_linux_{version}_{arch}_fips.tar.gz"

Adding fips compliant agents to Prerelease on demand workflow #1942

Are you sure you want to change the base?

Adding fips compliant agents to Prerelease on demand workflow #1942

Conversation

nr-dadams commented Oct 25, 2024 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

nr-dadams commented Nov 19, 2024

alvarocabanas left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

nr-dadams commented Oct 25, 2024 •

edited

Loading