diff --git a/Dockerfile.rekor-server.rh b/Dockerfile.rekor-server.rh index 58ecb9562..bab355966 100644 --- a/Dockerfile.rekor-server.rh +++ b/Dockerfile.rekor-server.rh @@ -32,6 +32,7 @@ ADD ./pkg/ $APP_ROOT/src/pkg/ ARG SERVER_LDFLAGS RUN go build -ldflags "${SERVER_LDFLAGS}" -mod=readonly ./cmd/rekor-server +RUN go build -tags=fips -ldflags "${SERVER_LDFLAGS}" -o rekor-server-fips -mod=readonly ./cmd/rekor-server RUN go build -gcflags "all=-N -l" -ldflags "${SERVER_LDFLAGS}" -o rekor-server_debug -mod=readonly ./cmd/rekor-server RUN go test -c -ldflags "${SERVER_LDFLAGS}" -cover -covermode=count -coverpkg=./... -o rekor-server_test -mod=readonly ./cmd/rekor-server @@ -73,6 +74,7 @@ LABEL name="rhtas/rekor-server-rhel9" # Retrieve the binary from the previous stage COPY --from=build-env /opt/app-root/src/rekor-server /usr/local/bin/rekor-server +COPY --from=build-env /opt/app-root/src/rekor-server-fips /usr/local/bin/rekor-server-fips COPY LICENSE /licenses/license.txt USER 65532:65532 diff --git a/cmd/rekor-server/main.go b/cmd/rekor-server/main.go index 8e160e859..57bc56315 100644 --- a/cmd/rekor-server/main.go +++ b/cmd/rekor-server/main.go @@ -1,3 +1,7 @@ +//go:build !fips + +// RHTAS FIPS - DO NOT REMOVE + // // Copyright 2021 The Sigstore Authors. // diff --git a/cmd/rekor-server/main_fips.go b/cmd/rekor-server/main_fips.go new file mode 100644 index 000000000..858b62d60 --- /dev/null +++ b/cmd/rekor-server/main_fips.go @@ -0,0 +1,45 @@ +//go:build fips + +// RHTAS FIPS - DO NOT REMOVE + +// +// Copyright 2021 The Sigstore Authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +package main + +import ( + "fmt" + "os" + "strings" + + "github.com/sigstore/rekor/cmd/rekor-server/app" +) + +func init() { + data, err := os.ReadFile("/proc/sys/crypto/fips_enabled") + if err != nil { + fmt.Println("FIPS binary: could not read /proc/sys/crypto/fips_enabled") + return + } + if strings.TrimSpace(string(data)) == "1" { + fmt.Println("Rekor server is running in FIPS mode") + } else { + fmt.Println("WARNING: FIPS binary running on non-FIPS enabled system") + } +} + +func main() { + app.Execute() +}