Skip to content

Commit bcdf696

Browse files
erezrokaherezrokah
authored
feat: Add FIPS version (#19676)
#### Summary This PR is intended to add a FIPS version of the test source plugin, it works only for linux arm64 and amd64, since that's what `boringcrypto` [supports](https://github.com/golang/go/blob/4865aadc21acebc8039f914929f03c7042b2ae8d/src/crypto/boring/boring_test.go#L16). Needs cloudquery/plugin-sdk#1974 for validation
1 parent 337bddf commit bcdf696

File tree

7 files changed

+230
-1
lines changed

7 files changed

+230
-1
lines changed

‎.github/workflows/publish_plugin_to_hub_fips.yml‎

Lines changed: 122 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,122 @@
1+
name: Publish plugin to hub FIPS
2+
on:
3+
push:
4+
tags:
5+
- "plugins-source-test-v*.*.*"
6+
jobs:
7+
prepare:
8+
runs-on: ubuntu-latest
9+
outputs:
10+
plugin_name: ${{ steps.split.outputs.plugin_name }}
11+
plugin_kind: ${{ steps.split.outputs.plugin_kind }}
12+
plugin_version: ${{ steps.split.outputs.plugin_version }}-fips
13+
plugin_dir: ${{ steps.split.outputs.plugin_dir }}
14+
prerelease: ${{ steps.semver_parser.outputs.prerelease }}
15+
steps:
16+
- name: Split tag
17+
id: split
18+
run: |
19+
tag=${{ github.ref_name }}
20+
plugin_kind=$(echo $tag | cut -d- -f2)
21+
plugin_name=$(echo $tag | cut -d- -f3)
22+
plugin_version=$(echo $tag | cut -d- -f4-)
23+
# perform looping till either the plugin version passes our semver test or is empty
24+
until [[ $plugin_version =~ ^v?[0-9]+\.[0-9]+ ]] || [[ $(echo $plugin_version | wc -c) -eq 0 ]] ; do
25+
echo "${plugin_version} is not a valid version"
26+
plugin_name="$plugin_name-$(echo $plugin_version | cut -d- -f1)"
27+
plugin_version=$(echo $plugin_version | cut -d- -f2-)
28+
done
29+
echo "plugin_name=${plugin_name}" >> $GITHUB_OUTPUT
30+
echo "plugin_kind=${plugin_kind}" >> $GITHUB_OUTPUT
31+
echo "plugin_version=${plugin_version}" >> $GITHUB_OUTPUT
32+
echo "plugin_dir=plugins/${plugin_kind}/${plugin_name}" >> $GITHUB_OUTPUT
33+
34+
# Fail if not a valid SemVer string
35+
- name: Parse semver string
36+
uses: booxmedialtd/ws-action-parse-semver@7784200024d6b3fc01253e617ec0168daf603de3
37+
id: semver_parser
38+
with:
39+
input_string: ${{steps.split.outputs.plugin_version}}
40+
- name: Checkout
41+
uses: actions/checkout@v4
42+
43+
publish-plugin-to-hub-fips:
44+
timeout-minutes: 60
45+
runs-on: ubuntu-latest
46+
container:
47+
image: ghcr.io/cloudquery/golang-cross:v10.0.0
48+
env:
49+
CC: /usr/bin/gencc.sh
50+
CXX: /usr/bin/gencpp.sh
51+
needs:
52+
- prepare
53+
steps:
54+
- name: Checkout
55+
uses: actions/checkout@v4
56+
with:
57+
fetch-depth: 0
58+
59+
- uses: actions/cache@v4
60+
with:
61+
path: |
62+
~/.cache/go-build
63+
~/go/pkg/mod
64+
key: ${{ runner.os }}-go-1.22.4-publish-plugin-to-hub-fips-cache-${{ hashFiles(format('{0}/{1}', needs.prepare.outputs.plugin_dir, 'go.sum')) }}
65+
restore-keys: |
66+
${{ runner.os }}-go-1.22.4-publish-plugin-to-hub-fips-cache-plugins-${{ needs.prepare.outputs.plugin_kind }}-${{ needs.prepare.outputs.plugin_name }}
67+
68+
- name: Set up Go 1.x
69+
uses: actions/setup-go@v5
70+
with:
71+
go-version-file: ${{ needs.prepare.outputs.plugin_dir }}/go.mod
72+
cache: false
73+
74+
# Needed for shell escape
75+
- name: Use Node.js LTS
76+
uses: actions/setup-node@v4
77+
with:
78+
node-version: "lts/*"
79+
80+
- name: Install shell escape
81+
run: |
82+
npm install shell-escape@0.2.0
83+
84+
- name: Get Release Notes
85+
id: release-notes
86+
uses: actions/github-script@v7
87+
env:
88+
PRERELEASE: ${{ needs.prepare.outputs.prerelease }}
89+
with:
90+
result-encoding: string
91+
script: |
92+
const shellescape = require('shell-escape');
93+
const { PRERELEASE } = process.env;
94+
if (PRERELEASE) {
95+
return shellescape(["This is a pre-release version of the plugin and should be used for testing purposes only"])
96+
}
97+
const { data } = await github.rest.repos.getReleaseByTag({
98+
owner: "cloudquery",
99+
repo: context.repo.repo,
100+
tag: context.ref.replace('refs/tags/', ''),
101+
});
102+
return shellescape([data.body]);
103+
104+
- name: Find and Replace
105+
uses: jacobtomlinson/gha-find-replace@3a8ed858a4e3fb487c6f53658ec40b2b1d45d9d8
106+
with:
107+
find: "(?i)version_${{ needs.prepare.outputs.plugin_kind }}_${{ needs.prepare.outputs.plugin_name }}"
108+
replace: ${{ needs.prepare.outputs.plugin_version }}
109+
include: ${{ needs.prepare.outputs.plugin_dir }}/docs/*.md
110+
111+
- name: Run package command
112+
working-directory: ${{ needs.prepare.outputs.plugin_dir }}
113+
env:
114+
GOEXPERIMENT: "boringcrypto"
115+
run: |
116+
rm -rf docs/tables.md
117+
go run main.go package -m ${{ steps.release-notes.outputs.result }} ${{ needs.prepare.outputs.plugin_version }} .
118+
119+
- name: Setup CloudQuery
120+
uses: cloudquery/setup-cloudquery@v4
121+
with:
122+
version: v6.11.2

‎.github/workflows/source_test.yml‎

Lines changed: 46 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -55,4 +55,49 @@ jobs:
5555
run: go build .
5656
- name: Test
5757
run: make test
58-
58+
validate-fips:
59+
timeout-minutes: 30
60+
runs-on: ubuntu-latest
61+
container:
62+
image: ghcr.io/cloudquery/golang-cross:v10.0.0
63+
env:
64+
CC: /usr/bin/gencc.sh
65+
CXX: /usr/bin/gencpp.sh
66+
defaults:
67+
run:
68+
working-directory: ./plugins/source/test
69+
steps:
70+
- name: Checkout
71+
uses: actions/checkout@v4
72+
73+
- uses: actions/cache@v4
74+
with:
75+
path: |
76+
~/.cache/go-build
77+
~/go/pkg/mod
78+
key: ${{ runner.os }}-go-1.22.4-validate-plugin-fips-cache-${{ hashFiles('plugins/source/test/go.sum') }}
79+
restore-keys: |
80+
${{ runner.os }}-go-1.22.4-validate-plugin-fips-cache-source-test
81+
82+
- name: Set up Go 1.x
83+
uses: actions/setup-go@v5
84+
with:
85+
go-version-file: plugins/source/test/go.mod
86+
cache: false
87+
88+
- name: Run package command
89+
env:
90+
GOEXPERIMENT: "boringcrypto"
91+
run: |
92+
rm -rf docs/tables.md
93+
go run main.go package -m "chore: Test FIPS" "v1.0.0" .
94+
95+
- name: Unzip package artifacts
96+
run: |
97+
unzip -o dist/plugin-test-v1.0.0-linux-amd64.zip
98+
chmod +x plugin-test-v1.0.0-linux-amd64
99+
./plugin-test-v1.0.0-linux-amd64 --version
100+
101+
- name: Validate FIPS build
102+
run: |
103+
go tool nm plugin-test-v1.0.0-linux-amd64 | grep -E 'sig.FIPSOnly|sig.BoringCrypto'

‎plugins/source/test/main.go‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,5 @@
1+
//go:build !(linux && boringcrypto)
2+
13
package main
24

35
import (

‎plugins/source/test/main_fips.go‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
//go:build linux && boringcrypto
2+
3+
package main
4+
5+
import (
6+
"context"
7+
_ "crypto/tls/fipsonly"
8+
"log"
9+
10+
"github.com/cloudquery/cloudquery/plugins/source/test/resources/plugin"
11+
"github.com/cloudquery/plugin-sdk/v4/serve"
12+
)
13+
14+
func main() {
15+
p := serve.Plugin(plugin.Plugin())
16+
if err := p.Serve(context.Background()); err != nil {
17+
log.Fatalf("failed to serve plugin: %v", err)
18+
}
19+
}

‎plugins/source/test/resources/plugin/plugin.go‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,5 @@
1+
//go:build !(linux && boringcrypto)
2+
13
package plugin
24

35
import (

‎plugins/source/test/resources/plugin/plugin_fips.go‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
//go:build linux && boringcrypto
2+
3+
package plugin
4+
5+
import (
6+
"github.com/cloudquery/cloudquery/plugins/source/test/client"
7+
"github.com/cloudquery/plugin-sdk/v4/plugin"
8+
)
9+
10+
var (
11+
Name = "test"
12+
Kind = "source"
13+
Team = "cloudquery"
14+
Version = "development"
15+
)
16+
17+
func Plugin() *plugin.Plugin {
18+
return plugin.NewPlugin(
19+
Name,
20+
Version,
21+
Configure,
22+
plugin.WithKind(Kind),
23+
plugin.WithTeam(Team),
24+
plugin.WithJSONSchema(client.JSONSchema),
25+
plugin.WithConnectionTester(TestConnection),
26+
plugin.WithBuildTargets([]plugin.BuildTarget{
27+
{OS: plugin.GoOSLinux, Arch: plugin.GoArchAmd64, CGO: true, IncludeSymbols: true},
28+
{OS: plugin.GoOSLinux, Arch: plugin.GoArchArm64, CGO: true, IncludeSymbols: true},
29+
}),
30+
)
31+
}

‎scripts/workflows/wait_for_required_workflows.js‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -62,6 +62,14 @@ module.exports = async ({github, context}) => {
6262
}
6363
}
6464

65+
const pluginsWithFipsVersion = ["plugins/source/test"]
66+
for (const action of actions) {
67+
if (pluginsWithFipsVersion.includes(action)) {
68+
console.log(`Adding validate-fips to the list of required workflows for plugin ${action}`)
69+
actions = [...actions, 'validate-fips']
70+
}
71+
}
72+
6573
pendingActions = [...actions]
6674
console.log(`Waiting for ${pendingActions.join(", ")}`)
6775
while (now <= deadline) {

0 commit comments

Comments
 (0)