Skip to content

Revert go crypto on release/0.18 #1952

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
bernot-dev merged 8 commits into from
Jun 5, 2026
Merged

Revert go crypto on release/0.18 #1952

Show file tree
Hide file tree
Changes from 3 commits
Commits
Show all changes
8 commits
Select commit Hold shift + click to select a range
e147b79
chore: revert go crypto
bernot-dev Jun 4, 2026
aa0b6d3
chore: enable BoringCrypto in go-synthetic Dockerfile
bernot-dev Jun 4, 2026
73dadc7
fix: export CC inside cross-compilation block and add ARG BUILDARCH
bernot-dev Jun 4, 2026
2db92dd
fix: run apt-get update prior to installing cross-compilation toolchain
bernot-dev Jun 4, 2026
f37f7a9
fix: switch runtime image to gke-distroless libc for cgo dynamic linking
bernot-dev Jun 4, 2026
54ac61d
fix: redeclare target and build architecture args in appbase stage
bernot-dev Jun 4, 2026
9295b18
build: remove useless args
bernot-dev Jun 4, 2026
e0cacd3
fix: install reverse cross-compiler when building on arm64 host for a…
bernot-dev Jun 4, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 3 additions & 0 deletions .golangci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -106,6 +106,7 @@ linters:
modernize:
disable:
- omitzero
- waitgroupgo
revive:
enable-all-rules: true
rules:
Expand Down Expand Up @@ -225,6 +226,8 @@ linters:
- name: enforce-switch-style
severity: warning
disabled: true
- name: use-waitgroup-go
disabled: true
exclusions:
generated: lax
rules:
Expand Down
2 changes: 1 addition & 1 deletion Makefile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -115,7 +115,7 @@ bin-go:
@echo ">> building binaries"
ifeq ($(NO_DOCKER), 1)
if [ "$(BIN_GO_NAME)" = "frontend" ]; then pkg/ui/build.sh; fi
CGO_ENABLED=0 GOEXPERIMENT=noboringcrypto GOFIPS140=certified go build -tags builtinassets -o ./build/bin/$(BIN_GO_NAME) ./$(BIN_GO_DIR)/$(BIN_GO_NAME)/*.go
CGO_ENABLED=0 go build -tags builtinassets -o ./build/bin/$(BIN_GO_NAME) ./$(BIN_GO_DIR)/$(BIN_GO_NAME)/*.go
# If pushing, build and tag native arch image to GCR.
else ifeq ($(DOCKER_PUSH), 1)
$(call docker_build, --tag gmp/$(BIN_GO_NAME) -f ./$(BIN_GO_DIR)/$(BIN_GO_NAME)/Dockerfile .)
Expand Down
15 changes: 11 additions & 4 deletions cmd/config-reloader/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,6 +15,7 @@
FROM --platform=$BUILDPLATFORM google-go.pkg.dev/golang:1.26.4@sha256:3444149d0a7e3f7cfb9c2db65f0f75676fe6ad04de3ce72674efb120c08dd1c1 AS buildbase
ARG TARGETOS
ARG TARGETARCH
ARG BUILDARCH
WORKDIR /app
COPY charts/values.global.yaml charts/values.global.yaml
COPY go.mod go.mod
Expand All @@ -24,13 +25,19 @@ COPY go.sum go.sum
COPY vendor* vendor
COPY cmd cmd

ENV GOEXPERIMENT=noboringcrypto
ENV CGO_ENABLED=0
ENV GOFIPS140=certified
ENV GOEXPERIMENT=boringcrypto
ENV CGO_ENABLED=1
ENV GOFIPS140=off
ENV GOTOOLCHAIN=local
ENV GOOS=${TARGETOS}
ENV GOARCH=${TARGETARCH}
RUN go build \
RUN if [ "${TARGETARCH}" = "arm64" ] && [ "${BUILDARCH}" != "arm64" ]; then \
apt install -y --no-install-recommends \
gcc-aarch64-linux-gnu libc6-dev-arm64-cross; \
export CC=aarch64-linux-gnu-gcc; \
fi && \
Comment thread
bernot-dev marked this conversation as resolved.
Comment thread
bernot-dev marked this conversation as resolved.
GOOS=${TARGETOS} GOARCH=${TARGETARCH} \
go build \
Comment thread
bernot-dev marked this conversation as resolved.
Comment thread
bernot-dev marked this conversation as resolved.
-ldflags="-X github.com/prometheus/common/version.Version=$(cat charts/values.global.yaml | go tool yq '.version' ) \
-X github.com/prometheus/common/version.BuildDate=$(date --iso-8601=seconds)" \
-o config-reloader \
Expand Down
21 changes: 21 additions & 0 deletions cmd/config-reloader/boring.go
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,21 @@
// Copyright 2022 Google LLC
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
// https://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.

//go:build boring

package main

import (
_ "crypto/tls/fipsonly"
)
6 changes: 0 additions & 6 deletions cmd/config-reloader/main.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,7 +16,6 @@ package main

import (
"context"
"crypto/fips140"
"flag"
"net/http"
"net/url"
Expand Down Expand Up @@ -62,11 +61,6 @@ func main() {
logger = log.With(logger, "ts", log.DefaultTimestampUTC)
logger = log.With(logger, "caller", log.DefaultCaller)

if !fips140.Enabled() {
_ = level.Error(logger).Log("msg", "FIPS mode is required by security policy but could not be initialized")
os.Exit(1)
}

if *configDirOutput != "" && *configDir == "" {
//nolint:errcheck
level.Error(logger).Log("msg", "config-dir-output specified without config-dir")
Expand Down
15 changes: 11 additions & 4 deletions cmd/datasource-syncer/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,6 +15,7 @@
FROM --platform=$BUILDPLATFORM google-go.pkg.dev/golang:1.26.4@sha256:3444149d0a7e3f7cfb9c2db65f0f75676fe6ad04de3ce72674efb120c08dd1c1 AS buildbase
ARG TARGETOS
ARG TARGETARCH
ARG BUILDARCH
WORKDIR /app
COPY charts/values.global.yaml charts/values.global.yaml
COPY go.mod go.mod
Expand All @@ -24,13 +25,19 @@ COPY go.sum go.sum
COPY vendor* vendor
COPY cmd cmd

ENV GOEXPERIMENT=noboringcrypto
ENV CGO_ENABLED=0
ENV GOFIPS140=certified
ENV GOEXPERIMENT=boringcrypto
ENV CGO_ENABLED=1
ENV GOFIPS140=off
ENV GOTOOLCHAIN=local
ENV GOOS=${TARGETOS}
ENV GOARCH=${TARGETARCH}
RUN go build \
RUN if [ "${TARGETARCH}" = "arm64" ] && [ "${BUILDARCH}" != "arm64" ]; then \
apt install -y --no-install-recommends \
gcc-aarch64-linux-gnu libc6-dev-arm64-cross; \
export CC=aarch64-linux-gnu-gcc; \
fi && \
Comment thread
bernot-dev marked this conversation as resolved.
Comment thread
bernot-dev marked this conversation as resolved.
GOOS=${TARGETOS} GOARCH=${TARGETARCH} \
go build \
Comment thread
bernot-dev marked this conversation as resolved.
Comment thread
bernot-dev marked this conversation as resolved.
-ldflags="-X github.com/prometheus/common/version.Version=$(cat charts/values.global.yaml | go tool yq '.version' ) \
-X github.com/prometheus/common/version.BuildDate=$(date --iso-8601=seconds)" \
-o datasource-syncer \
Expand Down
21 changes: 21 additions & 0 deletions cmd/datasource-syncer/boring.go
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,21 @@
// Copyright 2022 Google LLC
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
// https://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.

//go:build boring

package main

import (
_ "crypto/tls/fipsonly"
)
6 changes: 0 additions & 6 deletions cmd/datasource-syncer/main.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,7 +16,6 @@ package main

import (
"context"
"crypto/fips140"
"crypto/tls"
"crypto/x509"
"errors"
Expand Down Expand Up @@ -67,11 +66,6 @@ func main() {
logger = log.With(logger, "ts", log.DefaultTimestampUTC)
logger = log.With(logger, "caller", log.DefaultCaller)

if !fips140.Enabled() {
_ = level.Error(logger).Log("msg", "FIPS mode is required by security policy but could not be initialized")
os.Exit(1)
}

if len(*datasourceUIDList) == 0 {
//nolint:errcheck
level.Error(logger).Log("msg", "--datasource-uid must be set")
Expand Down
15 changes: 11 additions & 4 deletions cmd/frontend/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -38,17 +38,24 @@ COPY --from=assets /app/pkg/ui/static pkg/ui/static
FROM buildbase AS appbase
ARG TARGETOS
ARG TARGETARCH
ARG BUILDARCH
WORKDIR /app
COPY charts/values.global.yaml charts/values.global.yaml
COPY --from=assets /app ./

ENV GOEXPERIMENT=noboringcrypto
ENV CGO_ENABLED=0
ENV GOFIPS140=certified
ENV GOEXPERIMENT=boringcrypto
ENV CGO_ENABLED=1
ENV GOFIPS140=off
ENV GOTOOLCHAIN=local
ENV GOOS=${TARGETOS}
ENV GOARCH=${TARGETARCH}
RUN go build \
RUN if [ "${TARGETARCH}" = "arm64" ] && [ "${BUILDARCH}" != "arm64" ]; then \
apt install -y --no-install-recommends \
gcc-aarch64-linux-gnu libc6-dev-arm64-cross; \
export CC=aarch64-linux-gnu-gcc; \
fi && \
Comment thread
bernot-dev marked this conversation as resolved.
Comment thread
bernot-dev marked this conversation as resolved.
GOOS=${TARGETOS} GOARCH=${TARGETARCH} \
go build \
Comment thread
bernot-dev marked this conversation as resolved.
Comment thread
bernot-dev marked this conversation as resolved.
-tags builtinassets \
-ldflags="-X github.com/prometheus/common/version.Version=$(cat charts/values.global.yaml | go tool yq ".version" ) \
-X github.com/prometheus/common/version.BuildDate=$(date --iso-8601=seconds)" \
Expand Down
21 changes: 21 additions & 0 deletions cmd/frontend/boring.go
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,21 @@
// Copyright 2022 Google LLC
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
// https://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.

//go:build boring

package main

import (
_ "crypto/tls/fipsonly"
)
6 changes: 0 additions & 6 deletions cmd/frontend/main.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,7 +21,6 @@ package main

import (
"context"
"crypto/fips140"
"crypto/sha256"
"crypto/subtle"
"errors"
Expand Down Expand Up @@ -87,11 +86,6 @@ func main() {
logger = log.With(logger, "ts", log.DefaultTimestampUTC)
logger = log.With(logger, "caller", log.DefaultCaller)

if !fips140.Enabled() {
_ = level.Error(logger).Log("msg", "FIPS mode is required by security policy but could not be initialized")
os.Exit(1)
}

switch strings.ToLower(*logLevel) {
case "debug":
logger = level.NewFilter(logger, level.AllowDebug())
Expand Down
15 changes: 11 additions & 4 deletions cmd/operator/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,6 +15,7 @@
FROM --platform=$BUILDPLATFORM google-go.pkg.dev/golang:1.26.4@sha256:3444149d0a7e3f7cfb9c2db65f0f75676fe6ad04de3ce72674efb120c08dd1c1 AS buildbase
ARG TARGETOS
ARG TARGETARCH
ARG BUILDARCH
WORKDIR /app
COPY charts/values.global.yaml charts/values.global.yaml
COPY go.mod go.mod
Expand All @@ -25,13 +26,19 @@ COPY vendor* vendor
COPY cmd cmd
COPY pkg pkg

ENV GOEXPERIMENT=noboringcrypto
ENV CGO_ENABLED=0
ENV GOFIPS140=certified
ENV GOEXPERIMENT=boringcrypto
ENV CGO_ENABLED=1
ENV GOFIPS140=off
ENV GOTOOLCHAIN=local
ENV GOOS=${TARGETOS}
ENV GOARCH=${TARGETARCH}
RUN go build \
RUN if [ "${TARGETARCH}" = "arm64" ] && [ "${BUILDARCH}" != "arm64" ]; then \
apt install -y --no-install-recommends \
gcc-aarch64-linux-gnu libc6-dev-arm64-cross; \
export CC=aarch64-linux-gnu-gcc; \
fi && \
Comment thread
bernot-dev marked this conversation as resolved.
Comment thread
bernot-dev marked this conversation as resolved.
GOOS=${TARGETOS} GOARCH=${TARGETARCH} \
go build \
Comment thread
bernot-dev marked this conversation as resolved.
Comment thread
bernot-dev marked this conversation as resolved.
-ldflags="-X github.com/prometheus/common/version.Version=$(cat charts/values.global.yaml | go tool yq '.version' ) \
-X github.com/prometheus/common/version.BuildDate=$(date --iso-8601=seconds)" \
-o operator \
Expand Down
21 changes: 21 additions & 0 deletions cmd/operator/boring.go
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,21 @@
// Copyright 2022 Google LLC
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
// https://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.

//go:build boring

package main

import (
_ "crypto/tls/fipsonly"
)
6 changes: 0 additions & 6 deletions cmd/operator/main.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,7 +16,6 @@ package main

import (
"context"
"crypto/fips140"
"errors"
"flag"
"net/http"
Expand Down Expand Up @@ -95,11 +94,6 @@ func main() {
logger.Error(err, "unable to fetch Google Cloud metadata")
}

if !fips140.Enabled() {
logger.Error(errors.New("FIPS mode required"), "FIPS mode is required by security policy but could not be initialized")
os.Exit(1)
}

cfg, err := ctrl.GetConfig()
if err != nil {
logger.Error(err, "loading kubeconfig failed")
Expand Down
15 changes: 11 additions & 4 deletions cmd/rule-evaluator/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,6 +15,7 @@
FROM --platform=$BUILDPLATFORM google-go.pkg.dev/golang:1.26.4@sha256:3444149d0a7e3f7cfb9c2db65f0f75676fe6ad04de3ce72674efb120c08dd1c1 AS buildbase
ARG TARGETOS
ARG TARGETARCH
ARG BUILDARCH
WORKDIR /app
COPY charts/values.global.yaml charts/values.global.yaml
COPY go.mod go.mod
Expand All @@ -26,13 +27,19 @@ COPY cmd cmd
COPY pkg pkg
COPY internal internal

ENV GOEXPERIMENT=noboringcrypto
ENV CGO_ENABLED=0
ENV GOFIPS140=certified
ENV GOEXPERIMENT=boringcrypto
ENV CGO_ENABLED=1
ENV GOFIPS140=off
ENV GOTOOLCHAIN=local
ENV GOOS=${TARGETOS}
ENV GOARCH=${TARGETARCH}
RUN go build \
RUN if [ "${TARGETARCH}" = "arm64" ] && [ "${BUILDARCH}" != "arm64" ]; then \
apt install -y --no-install-recommends \
gcc-aarch64-linux-gnu libc6-dev-arm64-cross; \
export CC=aarch64-linux-gnu-gcc; \
fi && \
Comment thread
bernot-dev marked this conversation as resolved.
Comment thread
bernot-dev marked this conversation as resolved.
GOOS=${TARGETOS} GOARCH=${TARGETARCH} \
go build \
Comment thread
bernot-dev marked this conversation as resolved.
Comment thread
bernot-dev marked this conversation as resolved.
-ldflags="-X github.com/prometheus/common/version.Version=$(cat charts/values.global.yaml | go tool yq '.version' ) \
-X github.com/prometheus/common/version.BuildDate=$(date --iso-8601=seconds)" \
-o rule-evaluator \
Expand Down
21 changes: 21 additions & 0 deletions cmd/rule-evaluator/boring.go
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,21 @@
// Copyright 2022 Google LLC
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
// https://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.

//go:build boring

package main

import (
_ "crypto/tls/fipsonly"
)
6 changes: 0 additions & 6 deletions cmd/rule-evaluator/main.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,7 +16,6 @@ package main

import (
"context"
"crypto/fips140"
"encoding/json"
"errors"
"fmt"
Expand Down Expand Up @@ -107,11 +106,6 @@ func main() {
logger = log.With(logger, "ts", log.DefaultTimestampUTC)
logger = log.With(logger, "caller", log.DefaultCaller)

if !fips140.Enabled() {
_ = level.Error(logger).Log("msg", "FIPS mode is required by security policy but could not be initialized")
os.Exit(1)
}

a := kingpin.New("rule", "The Prometheus Rule Evaluator")
logLevel := a.Flag("log.level",
"The level of logging. Can be one of 'debug', 'info', 'warn', 'error'").Default(
Expand Down
Loading
Loading