gravitational/teleport
1
0
Fork 0
mirror of https://github.com/gravitational/teleport.git synced 2026-10-11 22:49:54 +00:00
Code Issues Packages Projects Releases Wiki Activity

fips: Switch to Go-native FIPS140 builds from boring crypto (#66690)

Browse Source 
* fips: Switch to Go-native FIPS140 builds from boring crypto

Switch to using Go-native FIPS140 builds, using the GOFIPS140 build
environment variable, from the old boringcrypto FIPS140 build. The
latter is no longer supported now that Go supports FIPS140 builds
natively.

FIPS140 is enabled across the build when FIPS=1 is passed to `make` when
building. The main package of the binaries import the `lib/fipscheck`
package to ensure that a binary is not switched into or out of FIPS140
mode at launch time using the GODEBUG environment variable.

FIPS140 builds of OSS Teleport are not a supported configuration,
however the base of the Enterprise edition is the OSS repository, so
most of the changes are in this repository. Building OSS Teleport in
FIPS140 mode may not be complete.

* fips: Stop using fips buildbox

Stop using the fips buildbox for fips release builds, and just use the
normal centos7 buildbox. The fips buildbox sets
`GOEXPERIMENT=boringcrypto` which should no longer be set when building
with Go-native FIPS140. The fips buildbox is otherwise identical to the
non-fips buildbox.
This commit is contained in:
Cam Hutchison
2026-05-20 00:42:41 +00:00
committed by GitHub
parent 091a381cad
commit 54273f91fe
10 changed files with 54 additions and 35 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Makefile
+3 -3
View File
@@ -85,8 +85,8 @@ ifneq ("$(FIPS)","")
FIPS_TAG := fips
FIPS_MESSAGE := with-FIPS-support
RELEASE = teleport-$(GITTAG)-$(OS)-$(ARCH)-fips-bin
GOEXPERIMENT = boringcrypto
export GOEXPERIMENT
GOFIPS140 = v1.0.0
export GOFIPS140
ifeq ($(BUILDBOX_MODE),cross)
# We need to set CGO_ENABLED=0 when building rdpclient as the build of
# boring-sys builds and runs a Go program as part of its integrity testing.
@@ -438,7 +438,7 @@ $(BUILDDIR)/tbot:
.PHONY: $(BUILDDIR)/teleport-update
$(BUILDDIR)/teleport-update:
GOOS=$(OS) GOARCH=$(ARCH) CGO_ENABLED=0 go build -tags "grpcnotrace" -o $(BUILDDIR)/teleport-update $(BUILDFLAGS_TELEPORT_UPDATE) $(TOOLS_LDFLAGS) ./tool/teleport-update
GOOS=$(OS) GOARCH=$(ARCH) CGO_ENABLED=0 go build -tags "grpcnotrace $(FIPS_TAG)" -o $(BUILDDIR)/teleport-update $(BUILDFLAGS_TELEPORT_UPDATE) $(TOOLS_LDFLAGS) ./tool/teleport-update
TELEPORT_ARGS ?= start
.PHONY: teleport-hot-reload