Skip to content

ROX-24283: enable strictfipsruntime in Konflux builds #12909

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
BradLugo merged 1 commit into from
Jan 27, 2025
Merged

ROX-24283: enable strictfipsruntime in Konflux builds #12909

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 3 additions & 1 deletion image/rhel/konflux.Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -42,7 +42,9 @@ ENV BUILD_TAG="$BUILD_TAG"
ENV GOFLAGS=""
ENV CGO_ENABLED=1
# TODO(ROX-20240): enable non-release development builds.
ENV GOTAGS="release"
# TODO(ROX-27054): Remove the redundant strictfipsruntime option if one is found to be so.
ENV GOTAGS="release,strictfipsruntime"
ENV GOEXPERIMENT=strictfipsruntime
ENV CI=1

RUN # TODO(ROX-13200): make sure roxctl cli is built without running go mod tidy. \
Expand Down
4 changes: 3 additions & 1 deletion image/roxctl/konflux.Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,7 +20,9 @@ ENV BUILD_TAG="$BUILD_TAG"

ENV CI=1 GOFLAGS=""
# TODO(ROX-20240): enable non-release development builds.
ENV GOTAGS="release"
# TODO(ROX-27054): Remove the redundant strictfipsruntime option if one is found to be so.
ENV GOTAGS="release,strictfipsruntime"
ENV GOEXPERIMENT=strictfipsruntime

RUN RACE=0 CGO_ENABLED=1 GOOS=linux GOARCH=$(go env GOARCH) scripts/go-build.sh ./roxctl && \
cp bin/linux_$(go env GOARCH)/roxctl image/bin/roxctl
Expand Down
6 changes: 4 additions & 2 deletions make/env.mk
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,7 @@
SHELL := /bin/bash

colon := :
comma := ,

# GOPATH might actually be a colon-separated list of paths. For the purposes of this makefile,
# work with the first element only.
Expand Down Expand Up @@ -40,10 +41,11 @@ endif
TAG := # make sure tag is never injectable as an env var
RELEASE_GOTAGS := release

# Use a release go -tag when CI is targetting a tag
# Use a release go -tag when CI is targeting a tag
ifdef CI
ifneq ($(BUILD_TAG),)
GOTAGS := $(RELEASE_GOTAGS)
# Preserve existing GOTAGS and append release tags
GOTAGS := $(if $(GOTAGS),$(GOTAGS)$(comma))$(RELEASE_GOTAGS)
endif
endif

Expand Down
4 changes: 3 additions & 1 deletion operator/konflux.Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,7 +11,9 @@ RUN if [[ "$BUILD_TAG" == "" ]]; then >&2 echo "error: required BUILD_TAG arg is
ENV BUILD_TAG="$BUILD_TAG"

# TODO(ROX-20240): enable non-release development builds.
ENV GOTAGS="release"
# TODO(ROX-27054): Remove the redundant strictfipsruntime option if one is found to be so.
ENV GOTAGS="release,strictfipsruntime"
ENV GOEXPERIMENT=strictfipsruntime
ENV CI=1 GOFLAGS="" CGO_ENABLED=1

RUN GOOS=linux GOARCH=$(go env GOARCH) scripts/go-build-file.sh operator/cmd/main.go image/bin/operator
Expand Down
4 changes: 3 additions & 1 deletion scanner/image/scanner/konflux.Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,7 +14,9 @@ ENV BUILD_TAG="$BUILD_TAG"

ENV GOFLAGS=""
# TODO(ROX-20240): enable non-release development builds.
ENV GOTAGS="release"
# TODO(ROX-27054): Remove the redundant strictfipsruntime option if one is found to be so.
ENV GOTAGS="release,strictfipsruntime"
ENV GOEXPERIMENT=strictfipsruntime
ENV CI=1

COPY . /src
Expand Down