mirror of
https://github.com/gravitational/teleport.git
synced 2026-10-12 02:15:01 +00:00
Cam Hutchison
54273f91fe
* fips: Switch to Go-native FIPS140 builds from boring crypto Switch to using Go-native FIPS140 builds, using the GOFIPS140 build environment variable, from the old boringcrypto FIPS140 build. The latter is no longer supported now that Go supports FIPS140 builds natively. FIPS140 is enabled across the build when FIPS=1 is passed to `make` when building. The main package of the binaries import the `lib/fipscheck` package to ensure that a binary is not switched into or out of FIPS140 mode at launch time using the GODEBUG environment variable. FIPS140 builds of OSS Teleport are not a supported configuration, however the base of the Enterprise edition is the OSS repository, so most of the changes are in this repository. Building OSS Teleport in FIPS140 mode may not be complete. * fips: Stop using fips buildbox Stop using the fips buildbox for fips release builds, and just use the normal centos7 buildbox. The fips buildbox sets `GOEXPERIMENT=boringcrypto` which should no longer be set when building with Go-native FIPS140. The fips buildbox is otherwise identical to the non-fips buildbox.
Dockerized Teleport Build
This directory is used to produce a containerized production Teleport build. No need to have Golang. Only Docker is required.
It is a part of Gravitational CI/CD pipeline. To build Teleport type:
make
Safely updating build box Dockerfiles
The build box images are used in GitHub Actions. The resulting image is pushed to ghcr.io. This means that to safely introduce changes to Dockerfiles, those changes should be split into two stages:
- First you open a PR which updates a Dockerfile and get the PR merged.
- Once it's merged, GitHub Actions is going to pick it up, build a new build box image and push it to ghcr.io
- Then you can open another PR which starts using the new build box image.
DynamoDB static binary docker build
The static binary will be built along with all nodejs assets inside the container. From the root directory of the source checkout run:
docker build -f build.assets/Dockerfile.dynamodb -t teleportbuilder .
Then you can upload the result to an S3 bucket for release.
docker run -it -e AWS_ACL=public-read -e S3_BUCKET=my-teleport-releases -e AWS_ACCESS_KEY_ID -e AWS_SECRET_ACCESS_KEY teleportbuilder
Or simply copy the binary out of the image using a volume (it will be copied to current directory/build/teleport).
docker run -v $(pwd)/build:/builds -it teleportbuilder cp /gopath/src/github.com/gravitational/teleport/teleport.tgz /builds