Add the "Go BoringCrypto" toolchain for CI and releases #16
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This allows for builds that make use of multiple local toolchains. Signed-off-by: Aaron Jacobs <[email protected]>
This commit adds a second Go toolchain to the GitHub Actions environments used for builds, tests, and releases, as well as the related changes to GoReleaser's configuration. This "BoringCrypto" fork of Go's toolchain [0] is maintained by the Go team, and has become the de-facto way to provide FIPS-validated crypto for software written in Go. Binary releases are only available for Linux, so that is the only platform we can support ourselves for now. With this change, releases will have a new "rskey-fips" archive for the linux_amd64 target. This version of rskey will refuse to use cryptographic algorithms that are not FIPS approved, and may be broken in unexpected ways -- some caution is warranted. However, for customers that are in theory bound by FIPS-140, this may be a very appealing distribution of the tool. This commit does not include documentation for these new release binaries because no release yet includes them. [0]: https://go.googlesource.com/go/+/dev.boringcrypto/README.boringcrypto.md Signed-off-by: Aaron Jacobs <[email protected]>
atheriel
force-pushed
the
goboring-fips-builds
branch
from
06e26ce to
25ff0ef
Compare
This uses GitHub Action's federated OIDC support, so it does not require any explicit credentials. Signed-off-by: Aaron Jacobs <[email protected]>
atheriel
force-pushed
the
goboring-fips-builds
branch
3 times, most recently
from
663f0c4 to
3b50538
Compare
atheriel
force-pushed
the
goboring-fips-builds
branch
from
3b50538 to
fdd5eb9
Compare
atheriel
added
product-feature
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR adds a second Go toolchain to the GitHub Actions environments used for builds, tests, and releases, as well as the
related changes to GoReleaser's configuration. This was proposed in #2.
This "BoringCrypto" fork of Go's toolchain is maintained by the Go team, and has become the de-facto way to provide FIPS-validated crypto for software written in Go. Binary releases are only available for Linux, so that is the only platform we can support ourselves for now.
With this change, releases will have a new "rskey-fips" archive for the
linux_amd64target. This version of rskey will refuse to use cryptographic algorithms that are not FIPS approved, and may be broken in unexpected ways -- some caution is warranted. However, for customers that are in theory bound by FIPS-140, this may be a very appealing distribution of the tool.This PR does not include documentation for these new release binaries because no release yet includes them.