* add managed updates artifact signature verification
* updating signature max size to a more realistic, yet generous size
* fail teleport-update bulds when artifact verifier key is missing
* forward artifact signing key into Docker buildbox
* verify artifact signature over stream instead of pre-computed digest
* add insecure-skip-artifact-signature flag for dev builds
* renaming insecure signature flag and simplify verifier flow
* import separation for linter CI fix
* gofmt
* simplifying verifyArfifactSig function, table tests
* verify artifact signature during install, adding godoc for WithDigest
* adding staging CDN fallback
* updating isStagingCDN url check by adding helper function to check for raw vs want url equality, pr comments
* clarify ECDSA-specific digest verification comment
* initialize artifact signature verifier at construction time
* embed backup artifact signature public key for managed updates
* move teleport-update signature inputs to main.go
* removing comment
* verify staging signatures by default with explicit fallback
* update staging signature verification to trust prod artifacts
* fix test expected message error
* fips: Switch to Go-native FIPS140 builds from boring crypto
Switch to using Go-native FIPS140 builds, using the GOFIPS140 build
environment variable, from the old boringcrypto FIPS140 build. The
latter is no longer supported now that Go supports FIPS140 builds
natively.
FIPS140 is enabled across the build when FIPS=1 is passed to `make` when
building. The main package of the binaries import the `lib/fipscheck`
package to ensure that a binary is not switched into or out of FIPS140
mode at launch time using the GODEBUG environment variable.
FIPS140 builds of OSS Teleport are not a supported configuration,
however the base of the Enterprise edition is the OSS repository, so
most of the changes are in this repository. Building OSS Teleport in
FIPS140 mode may not be complete.
* fips: Stop using fips buildbox
Stop using the fips buildbox for fips release builds, and just use the
normal centos7 buildbox. The fips buildbox sets
`GOEXPERIMENT=boringcrypto` which should no longer be set when building
with Go-native FIPS140. The fips buildbox is otherwise identical to the
non-fips buildbox.
This commit does the following:
- Move existing smoke benchmark workflows to seperate workflow.
- Add differential benchmark workflows
- Split benchmarks into heavy and micro categories
- Add make target arguments for benchmark time and count
- Move smoketests to run only on PRs
- Differential benchmarks run on merge queue
Benchmarks above 1ms/op are considered heavy and should make
use of iteration based benchtime to prevent the CI job from taking
too much time. Benchmarks are skipped based on env vars, this is an
alternative to splitting benchmark targets into seperate files with
build tags.
The smoke tests should be much faster and as such are set to run
on PRs to ensure the targets are not broken in the change.
The current parameters for differential benchmarks attempt to balance
CI runner time and confidence for benchstat.
Differential benchmarks determine the base commit to run the tests against,
this happens within the same job to remove the runner to runner variance.
`teleport-update` is used to auto discover servers.
Sometimes it might be required to allow proxy conflicts, when we are
installing instances that were previously discovered by another cluster.
This is a simple fix for a single instance: just remove the
`teleport.yaml` file in target server.
However, for large clusters, this can be problematic.
Exposing this setting using an env var allows the Discovery Service to
conditionally set it.
Teleport can be installed using `teleport-update`.
When installing teleport with a suffix (ie `teleport-update -i`) it will
install teleport in non-default locations, as well as an expectation to
use non-default locations for data directory and configuration and a
different systemd unit name.
In this scenario, running `teleport install autodiscover` should use
those non-default values.
This PR changes that command to consider those, and not the default ones
when the `TELEPORT_INSTALL_SUFFIX` env var is set.
https://github.com/gravitational/teleport/issues/53050 was a result
of some expensive initialization that ended up impacting end users.
Existing benchmark tests did not cover this because they do not
actually launch the entire teleport binary.
The cost can be observed via `inittrace`, though it is documented
that the output is not stable and may be changed at any time.
```
GODEBUG='inittrace=1' ./releases/17.4.1/teleport version 2>&1 | rg '^init' | awk '{print $5 " ms " $2}' | sort -n -r | head -10
170 ms github.com/go-mysql-org/go-mysql/server
2.6 ms github.com/microsoft/go-mssqldb/internal/cp
2.6 ms github.com/goccy/go-json/internal/decoder
2.2 ms cloud.google.com/go/compute/apiv1/computepb
2.0 ms github.com/aws/aws-sdk-go/aws/endpoints
1.8 ms k8s.io/client-go/kubernetes/scheme
1.2 ms github.com/gravitational/teleport/lib/kube/proxy
1.2 ms github.com/gogo/protobuf/types
0.78 ms k8s.io/kubectl/pkg/scheme
0.73 ms github.com/gravitational/teleport/lib/kube/proxy/testing/kube_server
```
In order to cover in a stable way, new tests were added to the tool
package of each binary. The tests does one basic thing, re-execute
the test binary and exits. The re-execution is required to account
for any initialization costs that would otherwise be missed since
they happen prior to TestMain being called.
* add metadata
* newline
* cleanup status error
* refactor status error
* fix print
* order
* fix test on linux
* Truncate time to ms
* add host param to request
* jitter locally
* rename host to id
* rename func var
* Add templates for client tools auto-update download url
* Change to base url setting by env
MakeURL moved to common function to be general for both, agent and client tools
* Reuse MakeURL moved to common package
* Fix linter warning
* Add common env variable to override base url
* Remove template from interface
* Make template exported
Change a stale comment
* Remove unused code
* Add main.go
* wip
* group flag
* wip
* wip
* mvp
* wip
* separate files
* cleanup
* jitter
* scaffold only
* remove teleport changes
* remove teleport changes - group
* test
* test lock
* remove edition
* feedback
* clarify default data dir
* cleanup
* move version to status
* consistent naming for update.yaml
* improve lock test
* explain lint
* use shared locking logic
* fix test
* Move disable logic to lib
* feedback
* switch to default transport
Angel Dionisio