* add managed updates artifact signature verification
* updating signature max size to a more realistic, yet generous size
* fail teleport-update bulds when artifact verifier key is missing
* forward artifact signing key into Docker buildbox
* verify artifact signature over stream instead of pre-computed digest
* add insecure-skip-artifact-signature flag for dev builds
* renaming insecure signature flag and simplify verifier flow
* import separation for linter CI fix
* gofmt
* simplifying verifyArfifactSig function, table tests
* verify artifact signature during install, adding godoc for WithDigest
* adding staging CDN fallback
* updating isStagingCDN url check by adding helper function to check for raw vs want url equality, pr comments
* clarify ECDSA-specific digest verification comment
* initialize artifact signature verifier at construction time
* embed backup artifact signature public key for managed updates
* move teleport-update signature inputs to main.go
* removing comment
* verify staging signatures by default with explicit fallback
* update staging signature verification to trust prod artifacts
* fix test expected message error
* Make helm unit tests use hard-coded version to avoid updating snapshots with each release.
* Remove helm unittests after version update
* Used v99 for tests
* Detect Rust misconfigurations at build time
Addresses some confusion reported in #68265
* Update macOS helm unittest docs
---------
Co-authored-by: Nick Cellino <[email protected]>
* Replace references to archived helm-unittest plugin
Signed-off-by: Jacob Boykin <[email protected]>
* Point users to make target and ensure plugin env for macos
Signed-off-by: Jacob Boykin <[email protected]>
---------
Signed-off-by: Jacob Boykin <[email protected]>
* Add instructions for new helm unittest version
* Corrected missing verify false flag
* Added checksum verification for helm unittest plugin
* Helm unittest checksum for entire tarball
* Fixed globbing
* Added intel mac just in case
* Upgraded helm unittest plugin
* Implement guarenteed helm unittest version at runtime
* Use bash for helm-unittest install so we can have pipefail
* Fix unittest version check
* Fixed dup unittest plugins
* Fixed helm unittest version copy command in Dockerfile
* Fixed version test
* Add `generic_oidc` join method
This adds a new `generic_oidc` join method, suitable for joining most
OIDC providers using arbitrary rules.
In addition to standard OIDC it additionally supports custom CAs
(embedded in the token), along with `static_jwks` for configurations
where Teleport cannot directly access the issuer to fetch discovery
configuration.
* Reenable GenericOIDC in this PR
* Fix failing test
* Apply fixes from LLM review
Includes fixes for various typos, missing validations, and a couple
instances of improper error handling and logging.
* Validate non-oneof condition operator count manually
* Add scoped -> unscoped conversion test coverage
* Fix imports
* Mask errors from validation library
The library emits detailed errors now, so mask those errors from
unauth'd clients until we have a better system for exposing them to
end users.
* Convert to opaque API to resolve lint
* Add generic_oidc URL safe mapping
* Address small batch of review comments
* Add note about default timeout value
* Fix outdated comment
* Enable goderive for lib/config and use a go-derive equals helper
This replaces the `reflect.DeepEqual()` call with a go-derive
generated equals helper to determine deep equality for the embedded
`[]string` Command.
* Remove unused jointest helpers for generic_oidc
* Fix typo'd IsEqual check
* Add E2E style test for generic_oidc joining
This adds unscoped (and equivalent scoped) test cases to verify E2E
generic_oidc joining. A test helper was also moved from
lib/join/genericoidc to api/types/ since it's now used across
packages.
* Embedded Enroll.xcframework building into the main Xcode build
* Remove xcframework generation from Makefile
Now that Enroll.xcframework is built as part of the Xcode build, we no
longer need to maintain a separate step to build it manually.
* Add a README file with basic instructions on how to integrate Swift with Go packages
* Disable user script sandboxing
This ensures that our build scripts can read/write whatever files
necessary. In particular, this avoids issues when building xcframeworks
with `gomobile` that may touch files not declared in your file inputs.
* Fix typo in build-enroll-framework.sh
* Update build-enroll-framework.sh to call `gomobile` via `go tool`
* Resolve shellcheck lint failure SC2155
* Generate Xcode project for Verify
* Set Swift version to 6; remove macOS and Vision as destinations
* Handle `teleport://` links and add enrollment screen
* Avoid building macOS-specific stuff on iOS
This is needed for gomobile to build our stuff from lib/mobile from the
next commit.
* Add `lib/mobile/verify/enroll` compiled with gomobile
* `lib/mobile`: Temporarily use private Device Trust service
The public gRPC service exists on the demo branch but not on this
branch. In order to make it possible to compile
`lib/mobile/verify/enroll`, temporarily use the private service which
has similar RPCs.
* Run `make go-mod-tidy-all`
* Make Swift app connect to public DT service on "Request Now" tap
* mobile: Add sheet for enroll request status
* Revert go.mod changes
This reverts commit b9af7a7614 and
2c00ecd7fa.
* Add `build.assets/tools/gomobile`
* Move gomobile back to main go.mod
This reverts commits 9b2a6c4ea3 and
a83c2959fa.
* fips: Switch to Go-native FIPS140 builds from boring crypto
Switch to using Go-native FIPS140 builds, using the GOFIPS140 build
environment variable, from the old boringcrypto FIPS140 build. The
latter is no longer supported now that Go supports FIPS140 builds
natively.
FIPS140 is enabled across the build when FIPS=1 is passed to `make` when
building. The main package of the binaries import the `lib/fipscheck`
package to ensure that a binary is not switched into or out of FIPS140
mode at launch time using the GODEBUG environment variable.
FIPS140 builds of OSS Teleport are not a supported configuration,
however the base of the Enterprise edition is the OSS repository, so
most of the changes are in this repository. Building OSS Teleport in
FIPS140 mode may not be complete.
* fips: Stop using fips buildbox
Stop using the fips buildbox for fips release builds, and just use the
normal centos7 buildbox. The fips buildbox sets
`GOEXPERIMENT=boringcrypto` which should no longer be set when building
with Go-native FIPS140. The fips buildbox is otherwise identical to the
non-fips buildbox.
This commit enhances the CLI reference documentation by automatically
displaying valid enum values in the "Default" column of flag tables,
eliminating the need to manually list these values in flag descriptions.
It also adds a CI step to verify that CLI reference docs stay in sync
with source code changes.
The core implementation uses reflection to extract enum values from
kingpin flags and formats them as "(valid: `value1`, `value2`, ...)".
All CLI source files have been updated to remove duplicate enum value
lists from flag help text, as these are now automatically rendered.
A new 'cli-docs-up-to-date' Makefile target and corresponding GitHub
Actions workflow job ensure that any changes to CLI flags are reflected
in the generated documentation.
Example output:
Before: |`--format`|`yaml`|Output format, 'yaml', 'json', or 'text'|
After: |`--format`|`yaml` (valid: `yaml`, `json`, `text`)|Output format.|
Signed-off-by: Tiago Silva <[email protected]>
Update the targets in `build.assets/Makefile` to build fips binaries by
calling `release-ent` in the OSS Makefile instead of calling `release`
in the Enterprise Makefile. This allows the top-level Makefile to set up
things properly for building fips (GOEXPERIMENT, and soon GOFIPS140)
rather than having to duplicate it in the Enterprise Makefile or fips
buildbox.
This also means we no longer need to pass through VERSION and GITTAG to
the Enterprise make as this is set by the OSS Makefile.
Remove the guard on the `release-ent` target. That should fail if there
is no Enterprise repo checked out. Other places where it is guarded are
when it performs an OSS + maybe enterprise operation, which should not
fail. But an explicit call for `release-ent` should fail if the repo is
not checked out.
* refactor command and disk eBPF programs to fix some events not getting emitted
* fixed handling of flags in disk events
* remove unused constants to appease linter
* handle failing to read filename in enter_execve correctly
* added more tests
* prevent potential panic if args_len exceed args buffer size
* handle empty args in command events correctly
* minor changes from feedback
* update comments in eBPF files
---------
Co-authored-by: Andrew LeFevre <[email protected]>
The linker is now able to perform DCE for all binaries except tsh
and teleport. A change to enable DCE for teleport will come in the
future. DCE for tsh will be harder to achieve until kubectl dependencies
are capable of DCE.
This udpates e to include https://github.com/gravitational/teleport.e/pull/8447
which removes the last template usages in enterprise code. Now that
templates are no longer imported a depguard rule has been added to
prevent it from being imported in the future.
The last step to eliminate DCE was to add the grpcnotrace build tag
to all binaries.
Adds an additional accesslist.EqualAccessListsOption,
accesslist.WithIgnoreOktaUserManagedFields to support equality checking
which ignoring Spec.Owners, Spec.MembershipRequires, spec.OwnershipRequires,
and Spec.Audit. This will be used to replace the current go-cmp usage
to determine whether modification of Okta Access Lists are allowed.
(AccessListMember) IsEqual has been restored with a goderived implementation
which checks full equality. This was removed in https://github.com/gravitational/teleport/pull/64542
to prevent accidental use with a services.Reconciler. As of
https://github.com/gravitational/teleport/pull/65151, the Reconcilers
require an explicit comparison function instead of implicitly using
an IsEqual implementation the concerns which led to removing the IsEqual
are slightly mitigated.
* Run E2E tests in CI
* Rename results JSON so upload-artifacts finds it
* Skip failing auth connector test
* Remove e2e's pnpm workspace, add it to root
* Use cache v5
* Change paths-filter checkout to only on merge group
* Add timeout to e2e tests job
* Only run build/test if there are changes
* Cache the pnpm store instead of node_modules
* Add rust-toolchain.toml to changed files detection
* Add rust-toolchain.toml and Makefile to Rust cache hash
* Add build.assets/Makefile to Rust cache too
* Expand the path filters to capture more changes
* Improve the build error reporting, upload failure logs as artifacts
* Add `contents:read` permission for checkout in merge_group/push triggers
* Cancel previous jobs on new push in a PR
* Move type checking to earlier to fail faster
* Use the correct glob syntax
* Remove redundant env var
* Validate playwright version before trying to get the container
* Use fetch-depth: 1 for faster checkouts
* Use bash for pipefail
* Add versions.mk to changes detection and Rust cache key
* Use bash for version checking
* Ensure build is successful before running tests
* Exit with code 1 if any build failed
* Remove redundant corepack enable
* Use exit $failed for consistency
* Exit as early as possible if e2e type-checking errors
* Remove pnpm store cache as pnpm install is fast enough
* Change playwright back to ^, remove validation, get version from installed
* Run playwright version getter in e2e dir
* Add nested Cargo.toml to paths filter
* Add --init to playwright container
* Add --ipc=host to playwright docker container
* stateRestoration.spec.ts: Limit number of `login` calls
This is to avoid running into auth rate limits when running the full
Connect test suite.
* Cleanup temp dir if `fs.cp` fails
* Remove typescript/node types from e2e package.json
* Move GitHub report to a separate step
* Add more pnpm stuff to paths filter
* Skip for dependabot PRs
* Add persist-credentials: false to checkout
* Move e2e binary building to a bash script
* Define the test results JSON path only once
* Move PR comment management to gh CLI calls instead of runner
* Add build-e2e-binaries.sh to paths filter
* Handle the possibility of a missing PR comment file
* Move PR comment posting to a separate job
* Always run the update-pr-comment job
* Print logs instead of uploading them
* Add the repo name to the concurrency group
* Up test timeout limit to 20s
* Add a SHA flag to the e2e report command
* Fix the GitHub comment not deleting on success
---------
Co-authored-by: Rafał Cieślak <[email protected]>
PR #34950 put OpenSSL into FIPS mode in the _build container_,
which causes any build tooling that relies on OpenSSL to use FIPS
crypto.
A result of that change is that we can no longer update our Rust
toolchain. The `cargo` utility shipped with Rust versions newer
than 1.86 depends on a newer version of OpenSSL, and when this
version runs in FIPS mode cargo itself is not able to fetch dependencies
from the public registry due to incompatible cipher suites.
Note: our build artifacts are still compiled against FIPS-validated
modules (Go's GOEXPERIMENT=boring, and Cloudflare's boring crate for
Rust).
Replaces `(AccessListMember) IsEqual` with a local goderived
implementation in local/services. All reconcilers
have been previously updated to specify their own comparison
function to prevent this change from breaking enterprise in
https://github.com/gravitational/teleport.e/pull/8233.
IsEqual was not updated to use the goderived implementation because
different use cases have different ideas about equality. A single
API to support them all is untenable and confusing. As a result the
callers are now responsible for adhering to their own equality
definitions. If in the future another use case arises that requires
full equality IsEqual may be reconsidered.
* Add a runner utility for E2E tests
* credentials -> usercredentials
* Use NotifyContext instead
* Add a comment about the port allocation
* Use `getByTestId`
* Update e2e/tests/auth.setup.ts
Co-authored-by: Nick Marais <[email protected]>
---------
Co-authored-by: Nick Marais <[email protected]>
This commit does the following:
- Move existing smoke benchmark workflows to seperate workflow.
- Add differential benchmark workflows
- Split benchmarks into heavy and micro categories
- Add make target arguments for benchmark time and count
- Move smoketests to run only on PRs
- Differential benchmarks run on merge queue
Benchmarks above 1ms/op are considered heavy and should make
use of iteration based benchtime to prevent the CI job from taking
too much time. Benchmarks are skipped based on env vars, this is an
alternative to splitting benchmark targets into seperate files with
build tags.
The smoke tests should be much faster and as such are set to run
on PRs to ensure the targets are not broken in the change.
The current parameters for differential benchmarks attempt to balance
CI runner time and confidence for benchstat.
Differential benchmarks determine the base commit to run the tests against,
this happens within the same job to remove the runner to runner variance.
The upload steps are non-blocking, should they
fail the workflow status will not be affected.
This commit also changes the way the test logs are created,
now each Makefile accepts `TEST_LOG_DIR` as an optional parameter,
defaulting to `./test-logs`. This allows the top level Makefile
to propagate the location for the sub modules to write their
junit output, such that the CI jobs do not need to track
which top level make target corresponds to which directory.
Instead a simple glob is used to grab all the xml JUNIT files.
This approach also allows more targets to be added or removed in the future
without modifying the CI job definitons. Another benefit is allowing
the caller to modify the output destination should we want to bundle
the files as job artifacts in the future.
Makes `TEST_LOG_DIR` an order only dep for all targets.
* [tools] add benchstat tool
Adds `golang.org/x/perf/cmd/benchstat` to tools.
Required for differential benchmarking.
Example:
```
make test-go-bench BENCH_OUTPUT=a.txt
make test-go-bench BENCH_OUTPUT=b.txt
make benchstat "BENCH_FILES=a.txt b.txt"
```
While the tool can be invoked directly, the Make target
provides a convient command for CI workflows.
* missing newline
* bump benchstat deps
Each go tool will now reside in a isolated dir under
`build.assets/tools`, this allows us to isolate the
deps of each tool from both main module without
merging them for tools. This should make reviewing
tools and dep changes easier at a glance and remove
noise from main module dep manifest.
Each tool is a Makefile var to allow easy overrides
over a macro which cannot be temporarily unset/overriden.
The tools have been added to common.mk for easy reuse
across OSS and e.
* Generate a tctl reference page
Add a `cli-docs-tctl` Make target and generate the page.
To allow the page to render, make the `tctl edit` help text more
consistent with that of other commands by using a single line for the
resource type/name argument.
This change adds 47 `tctl` commands not present in the current
reference.
Also change the default value of the `tctl recordings download`
`output-dir` flag to the system-independent "." value. Otherwise,
generating this page prints a system-specific file path.
Also make minor modifications to flag, argument, and command
descriptions to be consistent with messaging conventions in the docs.
* CLI ref generator: add arg/flag default overrides
In the CLI reference doc generator, make it possible to override default
argument and flag values. This is necessary when these values are
dynamic and system dependent, e.g., a user's home directory.
Add the `flag_default_overrides` and `arg_default_overrides` fields to
the generator config file. Use these fields to create template functions
that replace default values in a `*kingpin.FlagModel` or
`*kingpin.ArgModel`.
* Add flag default overrides for tctl reference
Configure flags with dynamic values to have hardcoded values in the
reference docs page so there is no need to edit the dynamic argument
logic in the tctl source.
This commit adds benchfind, a cli utility which can be used
to discover Benchmark test targets in a golang tree. The reason
this is useful in a large codebase is that to run `go test -bench ./...`
would require the linking of every test target binary. This can
take 1h+. Previously a `grep` expression was used to find targets:
```sh
grep --exclude-dir api --include "*_test.go" -lr testing.B . | xargs dirname | xargs go list | sort -u
```
The issue with this is that it can break when the tree contains
other go modules and requires handling of pipefail. Instead a single
utility is provided.
This can now be replaced with:
```sh
benchfind ./...
```
Note that the tool will respect module boundaries, instead of
having to explicitly exclude them, call the CLI multiple times with `-d`
flag.
Gavin Frazar