From 50278879c0216065681eac68d522730e6d2d2f55 Mon Sep 17 00:00:00 2001 From: Nan Liu Date: Fri, 21 Aug 2026 18:46:00 +0000 Subject: [PATCH] fix(butane,ignition): disable systemcrypto on CGO_ENABLED=0 static cross-builds Azure Linux 4.0's golang is the Microsoft build of Go, whose systemcrypto (OpenSSL) backend is baseline-enabled for Linux targets. Both packages build their native binary fine, then cross-compile static -redistributable Linux binaries with CGO_ENABLED=0. In that configuration the OpenSSL backend file is excluded (no cgo) while the nobackend fallback is also excluded (systemcrypto stays enabled), so crypto/internal/backend/fips140 references systemFIPSMode/backendEnabled with no file defining them and the build fails. Set MS_GO_NOSYSTEMCRYPTO=1 on those cgo-free static cross-builds so the pure-Go crypto implementation is used, keeping the redistributable binaries self-contained (no runtime OpenSSL). MS_GO_NOSYSTEMCRYPTO=1 is the documented, forward-compatible knob (Go 1.25.2 through 1.27+); GOEXPERIMENT=nosystemcrypto is removed and rejected in Go 1.27. ignition's GOEXPERIMENT= (empty) did not clear the platform baseline; butane supplied no override at all. The darwin/windows cross-builds and ignition's native strictfipsruntime binary are untouched. Overlays are per-file documents under each component's overlays/ directory; both components move from inline entries in components.toml to dedicated comp.toml files so the overlays are discovered. --- base/comps/butane/butane.comp.toml | 1 + ...temcrypto-static-cross-builds.overlay.toml | 22 +++++++++++++++++++ base/comps/components.toml | 2 -- base/comps/ignition/ignition.comp.toml | 1 + ...temcrypto-static-cross-builds.overlay.toml | 22 +++++++++++++++++++ locks/butane.lock | 2 +- locks/ignition.lock | 2 +- specs/b/butane/butane.spec | 10 ++++----- specs/i/ignition/ignition.spec | 10 ++++----- 9 files changed, 58 insertions(+), 14 deletions(-) create mode 100644 base/comps/butane/butane.comp.toml create mode 100644 base/comps/butane/overlays/0001-disable-systemcrypto-static-cross-builds.overlay.toml create mode 100644 base/comps/ignition/ignition.comp.toml create mode 100644 base/comps/ignition/overlays/0001-disable-systemcrypto-static-cross-builds.overlay.toml diff --git a/base/comps/butane/butane.comp.toml b/base/comps/butane/butane.comp.toml new file mode 100644 index 00000000000..e92c145d934 --- /dev/null +++ b/base/comps/butane/butane.comp.toml @@ -0,0 +1 @@ +[components.butane] diff --git a/base/comps/butane/overlays/0001-disable-systemcrypto-static-cross-builds.overlay.toml b/base/comps/butane/overlays/0001-disable-systemcrypto-static-cross-builds.overlay.toml new file mode 100644 index 00000000000..0c2cc6a348d --- /dev/null +++ b/base/comps/butane/overlays/0001-disable-systemcrypto-static-cross-builds.overlay.toml @@ -0,0 +1,22 @@ +# Azure Linux's golang is the Microsoft build of Go, whose systemcrypto (OpenSSL) +# backend is baseline-enabled for Linux targets. The -redistributable Linux binaries +# are cross-compiled static with CGO_ENABLED=0: the OpenSSL backend file is excluded +# (no cgo) but systemcrypto stays enabled, so no crypto backend file is selected and +# crypto/internal/backend/fips140 fails to compile (undefined systemFIPSMode/ +# backendEnabled). Disable systemcrypto for these cgo-free static cross-builds so the +# pure-Go crypto implementation is used, keeping the redistributable binaries +# self-contained (no runtime OpenSSL). Use the MS_GO_NOSYSTEMCRYPTO=1 env var, not +# GOEXPERIMENT=nosystemcrypto: it is the documented, forward-compatible knob (Go 1.25.2 +# through 1.27+), whereas GOEXPERIMENT=nosystemcrypto is removed and rejected in Go 1.27. +# butane supplies no GOEXPERIMENT override at all. +# Ref: https://github.com/microsoft/go/blob/8ef6cff0f34e983fb707a455292ed162e1ecc3ae/eng/doc/fips/README.md#build-option-to-use-go-crypto +[metadata] +category = "azl-compatibility" +upstream-status = "inapplicable" + +[[overlays]] +description = "Disable systemcrypto on the CGO_ENABLED=0 static Linux cross-builds via MS_GO_NOSYSTEMCRYPTO=1 (pure-Go crypto, self-contained): Microsoft Go baseline-enables the OpenSSL backend, which cannot compile without cgo; MS_GO_NOSYSTEMCRYPTO stays valid on Go 1.27 unlike the removed GOEXPERIMENT=nosystemcrypto" +type = "spec-search-replace" +section = "%build" +regex = '^CGO_ENABLED=0 GOARCH' +replacement = "MS_GO_NOSYSTEMCRYPTO=1 CGO_ENABLED=0 GOARCH" diff --git a/base/comps/components.toml b/base/comps/components.toml index eb444ed1899..b3bdf6e9e36 100644 --- a/base/comps/components.toml +++ b/base/comps/components.toml @@ -188,7 +188,6 @@ overlay-files = ["overlays/*.overlay.toml"] [components.buildah] [components.bullet] [components.busybox] -[components.butane] [components.byacc] [components.byaccj] [components.byte-buddy] @@ -1342,7 +1341,6 @@ overlay-files = ["overlays/*.overlay.toml"] [components.icoutils] [components.icu] [components.icu4j] -[components.ignition] [components.igraph] [components.igvm] [components.iio-sensor-proxy] diff --git a/base/comps/ignition/ignition.comp.toml b/base/comps/ignition/ignition.comp.toml new file mode 100644 index 00000000000..bd8c5351793 --- /dev/null +++ b/base/comps/ignition/ignition.comp.toml @@ -0,0 +1 @@ +[components.ignition] diff --git a/base/comps/ignition/overlays/0001-disable-systemcrypto-static-cross-builds.overlay.toml b/base/comps/ignition/overlays/0001-disable-systemcrypto-static-cross-builds.overlay.toml new file mode 100644 index 00000000000..ac3c05af98f --- /dev/null +++ b/base/comps/ignition/overlays/0001-disable-systemcrypto-static-cross-builds.overlay.toml @@ -0,0 +1,22 @@ +# Azure Linux's golang is the Microsoft build of Go, whose systemcrypto (OpenSSL) +# backend is baseline-enabled for Linux targets. The -redistributable Linux binaries +# are cross-compiled static with CGO_ENABLED=0: the OpenSSL backend file is excluded +# (no cgo) but systemcrypto stays enabled, so no crypto backend file is selected and +# crypto/internal/backend/fips140 fails to compile (undefined systemFIPSMode/ +# backendEnabled). Disable systemcrypto for these cgo-free static cross-builds so the +# pure-Go crypto implementation is used, keeping the redistributable binaries +# self-contained (no runtime OpenSSL). Use the MS_GO_NOSYSTEMCRYPTO=1 env var, not +# GOEXPERIMENT=nosystemcrypto: it is the documented, forward-compatible knob (Go 1.25.2 +# through 1.27+), whereas GOEXPERIMENT=nosystemcrypto is removed and rejected in Go 1.27. +# ignition's GOEXPERIMENT= (empty) does not clear the Microsoft Go platform baseline. +# Ref: https://github.com/microsoft/go/blob/8ef6cff0f34e983fb707a455292ed162e1ecc3ae/eng/doc/fips/README.md#build-option-to-use-go-crypto +[metadata] +category = "azl-compatibility" +upstream-status = "inapplicable" + +[[overlays]] +description = "Disable systemcrypto on the CGO_ENABLED=0 static Linux cross-builds via MS_GO_NOSYSTEMCRYPTO=1 (pure-Go crypto, self-contained): stays valid on Go 1.27 unlike the removed GOEXPERIMENT=nosystemcrypto; the native strictfipsruntime binary is unaffected" +type = "spec-search-replace" +section = "%build" +regex = '^GOEXPERIMENT= CGO_ENABLED=0' +replacement = "MS_GO_NOSYSTEMCRYPTO=1 GOEXPERIMENT= CGO_ENABLED=0" diff --git a/locks/butane.lock b/locks/butane.lock index 7c78891c5d2..ce6d7df2b6e 100644 --- a/locks/butane.lock +++ b/locks/butane.lock @@ -3,5 +3,5 @@ version = 1 import-commit = '80e122caba6bafc76bb9115370bfd1d3c21fb3ea' upstream-commit = '80e122caba6bafc76bb9115370bfd1d3c21fb3ea' manual-bump = 2 -input-fingerprint = 'sha256:9b956ec248a8160470bfc52fcf7ba2951f01a0f93412a2c57fa493c4d8706829' +input-fingerprint = 'sha256:2d345c1da17e2267ae629b501fad537d0da78895b7aff04487bbe55a07c0e36f' resolution-input-hash = 'sha256:466421704711c4fd3c71f0b2ed715a0e61d49e3e26f3a2637fee755795849c8e' diff --git a/locks/ignition.lock b/locks/ignition.lock index 760c808f6d2..a1f542f2d1d 100644 --- a/locks/ignition.lock +++ b/locks/ignition.lock @@ -3,5 +3,5 @@ version = 1 import-commit = '8b52f0328586e49ad5a0f6b403cf032e2449e050' upstream-commit = '8b52f0328586e49ad5a0f6b403cf032e2449e050' manual-bump = 2 -input-fingerprint = 'sha256:c2fe51adea2c92540c4de77eab58692355ddedde541eb719683ba62d276eb3a6' +input-fingerprint = 'sha256:764d0117c14900a8c8b90af8a4076410033f9b9421b87b0007b884d02eec1ca0' resolution-input-hash = 'sha256:466421704711c4fd3c71f0b2ed715a0e61d49e3e26f3a2637fee755795849c8e' diff --git a/specs/b/butane/butane.spec b/specs/b/butane/butane.spec index 6a8712edfde..3b2c7800509 100644 --- a/specs/b/butane/butane.spec +++ b/specs/b/butane/butane.spec @@ -25,7 +25,7 @@ configs for provisioning operating systems that use Ignition.} %global godocs docs README.md Name: butane -Release: 5%{?dist} +Release: 6%{?dist} Summary: Butane config transpiler License: Apache-2.0 @@ -102,10 +102,10 @@ echo "Building butane..." %global gocrossbuild go build -ldflags "${LDFLAGS:-} -B 0x$(head -c8 /dev/urandom|od -An -tx1|tr -d ' \\n')" -a -v -x echo "Building Linux Butane with static linking..." -CGO_ENABLED=0 GOARCH=arm64 GOOS=linux %gocrossbuild -o butane-aarch64-unknown-linux-gnu-static internal/main.go -CGO_ENABLED=0 GOARCH=ppc64le GOOS=linux %gocrossbuild -o butane-ppc64le-unknown-linux-gnu-static internal/main.go -CGO_ENABLED=0 GOARCH=s390x GOOS=linux %gocrossbuild -o butane-s390x-unknown-linux-gnu-static internal/main.go -CGO_ENABLED=0 GOARCH=amd64 GOOS=linux %gocrossbuild -o butane-x86_64-unknown-linux-gnu-static internal/main.go +MS_GO_NOSYSTEMCRYPTO=1 CGO_ENABLED=0 GOARCH=arm64 GOOS=linux %gocrossbuild -o butane-aarch64-unknown-linux-gnu-static internal/main.go +MS_GO_NOSYSTEMCRYPTO=1 CGO_ENABLED=0 GOARCH=ppc64le GOOS=linux %gocrossbuild -o butane-ppc64le-unknown-linux-gnu-static internal/main.go +MS_GO_NOSYSTEMCRYPTO=1 CGO_ENABLED=0 GOARCH=s390x GOOS=linux %gocrossbuild -o butane-s390x-unknown-linux-gnu-static internal/main.go +MS_GO_NOSYSTEMCRYPTO=1 CGO_ENABLED=0 GOARCH=amd64 GOOS=linux %gocrossbuild -o butane-x86_64-unknown-linux-gnu-static internal/main.go echo "Building macOS Butane..." GOARCH=amd64 GOOS=darwin %gocrossbuild -o butane-x86_64-apple-darwin internal/main.go diff --git a/specs/i/ignition/ignition.spec b/specs/i/ignition/ignition.spec index c1092c8c441..eedc80a5ed5 100644 --- a/specs/i/ignition/ignition.spec +++ b/specs/i/ignition/ignition.spec @@ -25,7 +25,7 @@ Version: 2.26.0 %global dracutlibdir %{_prefix}/lib/dracut Name: ignition -Release: 4%{?dist} +Release: 5%{?dist} Summary: First boot installer and configuration tool # Upstream license specification: Apache-2.0 @@ -286,10 +286,10 @@ echo "Building ignition-validate..." %if 0%{?fedora} echo "Building statically-linked Linux ignition-validate..." -GOEXPERIMENT= CGO_ENABLED=0 GOARCH=arm64 GOOS=linux %gocrossbuild -o ./ignition-validate-aarch64-unknown-linux-gnu-static validate/main.go -GOEXPERIMENT= CGO_ENABLED=0 GOARCH=ppc64le GOOS=linux %gocrossbuild -o ./ignition-validate-ppc64le-unknown-linux-gnu-static validate/main.go -GOEXPERIMENT= CGO_ENABLED=0 GOARCH=s390x GOOS=linux %gocrossbuild -o ./ignition-validate-s390x-unknown-linux-gnu-static validate/main.go -GOEXPERIMENT= CGO_ENABLED=0 GOARCH=amd64 GOOS=linux %gocrossbuild -o ./ignition-validate-x86_64-unknown-linux-gnu-static validate/main.go +MS_GO_NOSYSTEMCRYPTO=1 GOEXPERIMENT= CGO_ENABLED=0 GOARCH=arm64 GOOS=linux %gocrossbuild -o ./ignition-validate-aarch64-unknown-linux-gnu-static validate/main.go +MS_GO_NOSYSTEMCRYPTO=1 GOEXPERIMENT= CGO_ENABLED=0 GOARCH=ppc64le GOOS=linux %gocrossbuild -o ./ignition-validate-ppc64le-unknown-linux-gnu-static validate/main.go +MS_GO_NOSYSTEMCRYPTO=1 GOEXPERIMENT= CGO_ENABLED=0 GOARCH=s390x GOOS=linux %gocrossbuild -o ./ignition-validate-s390x-unknown-linux-gnu-static validate/main.go +MS_GO_NOSYSTEMCRYPTO=1 GOEXPERIMENT= CGO_ENABLED=0 GOARCH=amd64 GOOS=linux %gocrossbuild -o ./ignition-validate-x86_64-unknown-linux-gnu-static validate/main.go echo "Building macOS ignition-validate..." GOEXPERIMENT= GOARCH=amd64 GOOS=darwin %gocrossbuild -o ./ignition-validate-x86_64-apple-darwin validate/main.go