test: fips example

Dockerfile.rekor-server.rh

@@ -32,6 +32,7 @@ ADD ./pkg/ $APP_ROOT/src/pkg/
 
 ARG SERVER_LDFLAGS
 RUN go build -ldflags "${SERVER_LDFLAGS}" -mod=readonly ./cmd/rekor-server
+RUN go build -tags=fips -ldflags "${SERVER_LDFLAGS}" -o rekor-server-fips -mod=readonly ./cmd/rekor-server
 RUN go build -gcflags "all=-N -l" -ldflags "${SERVER_LDFLAGS}" -o rekor-server_debug -mod=readonly ./cmd/rekor-server
 RUN go test -c -ldflags "${SERVER_LDFLAGS}" -cover -covermode=count -coverpkg=./... -o rekor-server_test -mod=readonly ./cmd/rekor-server
 
@@ -73,6 +74,7 @@ LABEL name="rhtas/rekor-server-rhel9"
 
 # Retrieve the binary from the previous stage
 COPY --from=build-env /opt/app-root/src/rekor-server /usr/local/bin/rekor-server
+COPY --from=build-env /opt/app-root/src/rekor-server-fips /usr/local/bin/rekor-server-fips
 COPY LICENSE /licenses/license.txt
 
 USER 65532:65532

cmd/rekor-server/main.go

@@ -1,3 +1,7 @@
+//go:build !fips
+
+// RHTAS FIPS - DO NOT REMOVE
+
 //
 // Copyright 2021 The Sigstore Authors.
 //

cmd/rekor-server/main_fips.go

@@ -0,0 +1,45 @@
+//go:build fips
+
+// RHTAS FIPS - DO NOT REMOVE
+
+//
+// Copyright 2021 The Sigstore Authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package main
+
+import (
+	"fmt"
+	"os"
+	"strings"
+
+	"github.com/sigstore/rekor/cmd/rekor-server/app"
+)
+
+func init() {
+	data, err := os.ReadFile("/proc/sys/crypto/fips_enabled")
+	if err != nil {
+		fmt.Println("FIPS binary: could not read /proc/sys/crypto/fips_enabled")
+		return
+	}
+	if strings.TrimSpace(string(data)) == "1" {
+		fmt.Println("Rekor server is running in FIPS mode")
+	} else {
+		fmt.Println("WARNING: FIPS binary running on non-FIPS enabled system")
+	}
+}
+
+func main() {
+	app.Execute()
+}