Skip to content

Commit

Permalink
feat(fips): add fips compliant packages
Browse files Browse the repository at this point in the history
  • Loading branch information
rajrohanyadav committed Jan 29, 2025
1 parent d1f4fef commit e540026
Show file tree
Hide file tree
Showing 9 changed files with 124 additions and 45 deletions.
1 change: 1 addition & 0 deletions .github/workflows/on_prerelease.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -14,6 +14,7 @@ jobs:
integration: "cassandra"
windows_goarch_matrix: '["amd64"]' # 386 is not supported in jmx integrations
windows_download_nrjmx: true
upload_fips_packages: true
publish_schema: "ohi-jmx"
win_package_type: exe
secrets: inherit
1 change: 1 addition & 0 deletions .github/workflows/on_release.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -14,4 +14,5 @@ jobs:
integration: cassandra
tag: ${{ github.event.release.tag_name }}
publish_schema: "ohi-jmx"
upload_fips_packages: true
secrets: inherit
3 changes: 3 additions & 0 deletions CHANGELOG.md
Original file line number Diff line number Diff line change
Expand Up @@ -9,6 +9,9 @@ Unreleased section should follow [Release Toolkit](https://github.com/newrelic/r

## Unreleased

### enhancements
- Add FIPS compliant packages

## v2.14.1 - 2024-12-04

### ⛓️ Dependencies
Expand Down
2 changes: 2 additions & 0 deletions Makefile
Original file line number Diff line number Diff line change
Expand Up @@ -6,6 +6,8 @@ GO_FILES := ./src/
GOFLAGS = -mod=readonly
GOCOV = github.com/axw/gocov/gocov
GOCOV_XML = github.com/AlekSi/gocov-xml
GO_VERSION ?= $(shell grep '^go ' go.mod | awk '{print $$2}')
BUILDER_IMAGE ?= "ghcr.io/newrelic/coreint-automation:latest-go$(GO_VERSION)-ubuntu16.04"

all: build

Expand Down
108 changes: 93 additions & 15 deletions build/.goreleaser.yml
Original file line number Diff line number Diff line change
@@ -1,3 +1,6 @@
---
version: 2
project_name: nri-cassandra
builds:
- id: nri-nix
main: ./src
Expand All @@ -17,6 +20,24 @@ builds:
ignore:
- goos: darwin
goarch: 386

- id: nri-nix-fips
main: ./src
binary: nri-cassandra
ldflags:
- -s -w -X main.integrationVersion={{.Version}} -X main.gitCommit={{.Commit}} -X main.buildDate={{.Date}}
env:
- CGO_ENABLED=1
- GOEXPERIMENT=boringcrypto
- >-
{{- if eq .Arch "arm64" -}}
CC=aarch64-linux-gnu-gcc
{{- end }}
goos:
- linux
goarch:
- amd64
- arm64

- id: nri-win
main: ./src
Expand All @@ -34,7 +55,8 @@ builds:

nfpms:
- id: linux
file_name_template: "{{ .ProjectName }}_{{ .Version }}-1_{{ .Arch }}"
package_name: nri-cassandra
file_name_template: "{{ .PackageName }}_{{ .Version }}-1_{{ .Arch }}"
vendor: "New Relic, Inc."
homepage: "https://www.newrelic.com/infrastructure"
maintainer: "New Relic Infrastructure Team <[email protected]>"
Expand All @@ -45,8 +67,8 @@ nfpms:
- nri-nix

dependencies:
- newrelic-infra
- nrjmx
- newrelic-infra (>= 1.20.0)
- nrjmx (>= 2.3.2)

bindir: "/var/db/newrelic-infra/newrelic-integrations/bin"

Expand All @@ -66,19 +88,64 @@ nfpms:
type: config

overrides:
deb:
dependencies:
- newrelic-infra (>= 1.20.0)
- nrjmx (>= 2.3.2)
rpm:
file_name_template: "{{ .ProjectName }}-{{ .Version }}-1.{{ .Arch }}"
replacements:
amd64: x86_64
dependencies:
- newrelic-infra >= 1.20.0
- nrjmx >= 2.3.2

# Formats to be generated.
file_name_template: >-
{{- .ProjectName }}-
{{- .Version }}-1.
{{- if eq .Arch "amd64" -}}x86_64
{{- else -}}
{{ .Arch }}
{{- end }}
# Formats to be generated.
formats:
- deb
- rpm

- id: linux-fips
package_name: nri-cassandra-fips
file_name_template: "{{ .PackageName }}_{{ .Version }}-1_{{ .Arch }}"
vendor: "New Relic, Inc."
homepage: "https://www.newrelic.com/infrastructure"
maintainer: "New Relic Infrastructure Team <[email protected]>"
description: "New Relic Infrastructure cassandra Integration extend the core New Relic\nInfrastructure agent's capabilities to allow you to collect metric and\nlive state data from cassandra components."
license: "https://newrelic.com/terms (also see LICENSE installed with this package)"

builds:
- nri-nix-fips

dependencies:
- newrelic-infra (>= 1.20.0)
- nrjmx (>= 2.3.2)

bindir: "/var/db/newrelic-infra/newrelic-integrations/bin"

contents:
- src: "cassandra-config.yml.sample"
dst: "/etc/newrelic-infra/integrations.d/cassandra-config.yml.sample"
- src: "cassandra-log.yml.example"
dst: "/etc/newrelic-infra/logging.d/cassandra-log.yml.example"
- src: "CHANGELOG.md"
dst: "/usr/share/doc/nri-cassandra/CHANGELOG.md"
- src: "README.md"
dst: "/usr/share/doc/nri-cassandra/README.md"
- src: "LICENSE"
dst: "/usr/share/doc/nri-cassandra/LICENSE"
- src: "legacy/cassandra-definition.yml"
dst: "/var/db/newrelic-infra/newrelic-integrations/cassandra-definition.yml"
type: config

overrides:
rpm:
file_name_template: >-
{{- .ProjectName }}-fips-
{{- .Version }}-1.
{{- if eq .Arch "amd64" -}}x86_64
{{- else -}}
{{ .Arch }}
{{- end }}
# Formats to be generated.
formats:
- deb
- rpm
Expand All @@ -94,6 +161,17 @@ archives:
dst: .
strip_parent: true
format: tar.gz

- id: nri-nix-fips
builds:
- nri-nix-fips
name_template: "{{ .ProjectName }}-fips_{{ .Os }}_{{ .Version }}_{{ .Arch }}_dirty"
files:
- cassandra-config.yml.sample
- src: 'legacy/cassandra-definition.yml'
dst: .
strip_parent: true
format: tar.gz

- id: nri-win
builds:
Expand Down
18 changes: 0 additions & 18 deletions build/Dockerfile

This file was deleted.

17 changes: 9 additions & 8 deletions build/ci.mk
Original file line number Diff line number Diff line change
@@ -1,8 +1,9 @@
BUILDER_TAG ?= nri-$(INTEGRATION)-builder
.PHONY : ci/pull-builder-image
ci/pull-builder-image:
@docker pull $(BUILDER_IMAGE)

.PHONY : ci/deps
ci/deps:
@docker build -t $(BUILDER_TAG) -f $(CURDIR)/build/Dockerfile $(CURDIR)
ci/deps: ci/pull-builder-image

.PHONY : ci/debug-container
ci/debug-container: ci/deps
Expand All @@ -17,15 +18,15 @@ ci/debug-container: ci/deps
-e GPG_MAIL \
-e GPG_PASSPHRASE \
-e GPG_PRIVATE_KEY_BASE64 \
$(BUILDER_TAG) bash
$(BUILDER_IMAGE) bash

.PHONY : ci/test
ci/test: ci/deps
@docker run --rm -t \
--name "nri-$(INTEGRATION)-test" \
-v $(CURDIR):/go/src/github.com/newrelic/nri-$(INTEGRATION) \
-w /go/src/github.com/newrelic/nri-$(INTEGRATION) \
$(BUILDER_TAG) make test
$(BUILDER_IMAGE) make test

.PHONY : ci/snyk-test
ci/snyk-test:
Expand All @@ -46,7 +47,7 @@ ifdef TAG
-w /go/src/github.com/newrelic/nri-$(INTEGRATION) \
-e INTEGRATION \
-e TAG \
$(BUILDER_TAG) make release/build
$(BUILDER_IMAGE) make release/build
else
@echo "===> $(INTEGRATION) === [ci/build] TAG env variable expected to be set"
exit 1
Expand All @@ -67,7 +68,7 @@ ifdef TAG
-e GPG_MAIL \
-e GPG_PASSPHRASE \
-e GPG_PRIVATE_KEY_BASE64 \
$(BUILDER_TAG) make release
$(BUILDER_IMAGE) make release
else
@echo "===> $(INTEGRATION) === [ci/prerelease] TAG env variable expected to be set"
exit 1
Expand All @@ -90,7 +91,7 @@ ifdef TAG
-e GPG_MAIL \
-e GPG_PASSPHRASE \
-e GPG_PRIVATE_KEY_BASE64 \
$(BUILDER_TAG) make release
$(BUILDER_IMAGE) make release
else
@echo "===> $(INTEGRATION) === [ci/fake-prerelease] TAG env variable expected to be set"
exit 1
Expand Down
8 changes: 4 additions & 4 deletions build/release.mk
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
BUILD_DIR := ./bin/
GORELEASER_VERSION := v0.174.1
GORELEASER_VERSION := v2.4.4
GORELEASER_BIN ?= bin/goreleaser

bin:
Expand Down Expand Up @@ -27,10 +27,10 @@ release/deps: $(GORELEASER_BIN)
release/build: release/deps release/clean
ifeq ($(PRERELEASE), true)
@echo "===> $(INTEGRATION) === [release/build] PRE-RELEASE compiling all binaries, creating packages, archives"
@$(GORELEASER_BIN) release --config $(CURDIR)/build/.goreleaser.yml --rm-dist
@$(GORELEASER_BIN) release --config $(CURDIR)/build/.goreleaser.yml --clean
else
@echo "===> $(INTEGRATION) === [release/build] build compiling all binaries"
@$(GORELEASER_BIN) build --config $(CURDIR)/build/.goreleaser.yml --snapshot --rm-dist
@$(GORELEASER_BIN) build --config $(CURDIR)/build/.goreleaser.yml --snapshot --clean
endif

.PHONY : release/fix-archive
Expand All @@ -44,7 +44,7 @@ release/fix-archive:
release/sign/nix:
ifneq ($(NO_SIGN), true)
@echo "===> $(INTEGRATION) === [release/sign] signing packages"
@bash $(CURDIR)/build/nix/sign.sh
@bash sign.sh
else
@echo "===> $(INTEGRATION) === [release/sign] signing packages is disabled by environment variable"
endif
Expand Down
11 changes: 11 additions & 0 deletions src/fips.go
Original file line number Diff line number Diff line change
@@ -0,0 +1,11 @@
// Copyright 2025 New Relic Corporation. All rights reserved.
// SPDX-License-Identifier: Apache-2.0

//go:build fips
// +build fips

package main

import (
_ "crypto/tls/fipsonly"
)

0 comments on commit e540026

Please sign in to comment.