mirror of
https://github.com/gravitational/teleport.git
synced 2026-09-19 01:58:44 +08:00
Cam Hutchison
54273f91fe
* fips: Switch to Go-native FIPS140 builds from boring crypto Switch to using Go-native FIPS140 builds, using the GOFIPS140 build environment variable, from the old boringcrypto FIPS140 build. The latter is no longer supported now that Go supports FIPS140 builds natively. FIPS140 is enabled across the build when FIPS=1 is passed to `make` when building. The main package of the binaries import the `lib/fipscheck` package to ensure that a binary is not switched into or out of FIPS140 mode at launch time using the GODEBUG environment variable. FIPS140 builds of OSS Teleport are not a supported configuration, however the base of the Enterprise edition is the OSS repository, so most of the changes are in this repository. Building OSS Teleport in FIPS140 mode may not be complete. * fips: Stop using fips buildbox Stop using the fips buildbox for fips release builds, and just use the normal centos7 buildbox. The fips buildbox sets `GOEXPERIMENT=boringcrypto` which should no longer be set when building with Go-native FIPS140. The fips buildbox is otherwise identical to the non-fips buildbox.
38 lines
1.3 KiB
Go
38 lines
1.3 KiB
Go
//go:build fips
|
|
|
|
// Teleport
|
|
// Copyright (C) 2026 Gravitational, Inc.
|
|
//
|
|
// This program is free software: you can redistribute it and/or modify
|
|
// it under the terms of the GNU Affero General Public License as published by
|
|
// the Free Software Foundation, either version 3 of the License, or
|
|
// (at your option) any later version.
|
|
//
|
|
// This program is distributed in the hope that it will be useful,
|
|
// but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
// GNU Affero General Public License for more details.
|
|
//
|
|
// You should have received a copy of the GNU Affero General Public License
|
|
// along with this program. If not, see <http://www.gnu.org/licenses/>.
|
|
|
|
package fipscheck
|
|
|
|
import (
|
|
"crypto/fips140"
|
|
"fmt"
|
|
"os"
|
|
)
|
|
|
|
func init() {
|
|
// This guards against a user running teleport with `GODEBUG=fips140=off` set
|
|
// in their environment. They may be expecting this would disable FIPS140 mode
|
|
// with Teleport, but for that they need the non-fips build, as there is also a
|
|
// rust component that will have FIPS140 enabled.
|
|
if !fips140.Enabled() {
|
|
fmt.Fprintln(os.Stderr, "FIPS140 mode is not active in a FIPS build (GODEBUG=fips140=off).")
|
|
fmt.Fprintln(os.Stderr, "Install the non-FIPS Teleport OSS/Enterprise edition to disable FIPS140 mode.")
|
|
os.Exit(1)
|
|
}
|
|
}
|