Skip to content

fix(butane,ignition): disable systemcrypto on CGO_ENABLED=0 static cross-builds #18550

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
Nan Liu (liunan-ms) wants to merge 1 commit into
base: 4.0
Choose a base branch
from
+58 −14
Open

fix(butane,ignition): disable systemcrypto on CGO_ENABLED=0 static cross-builds #18550

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions base/comps/butane/butane.comp.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
[components.butane]
22 changes: 22 additions & 0 deletions base/comps/butane/overlays/0001-disable-systemcrypto-static-cross-builds.overlay.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,22 @@
# Azure Linux's golang is the Microsoft build of Go, whose systemcrypto (OpenSSL)
# backend is baseline-enabled for Linux targets. The -redistributable Linux binaries
# are cross-compiled static with CGO_ENABLED=0: the OpenSSL backend file is excluded
# (no cgo) but systemcrypto stays enabled, so no crypto backend file is selected and
# crypto/internal/backend/fips140 fails to compile (undefined systemFIPSMode/
# backendEnabled). Disable systemcrypto for these cgo-free static cross-builds so the
# pure-Go crypto implementation is used, keeping the redistributable binaries
# self-contained (no runtime OpenSSL). Use the MS_GO_NOSYSTEMCRYPTO=1 env var, not
# GOEXPERIMENT=nosystemcrypto: it is the documented, forward-compatible knob (Go 1.25.2
# through 1.27+), whereas GOEXPERIMENT=nosystemcrypto is removed and rejected in Go 1.27.
# butane supplies no GOEXPERIMENT override at all.
# Ref: https://github.com/microsoft/go/blob/8ef6cff0f34e983fb707a455292ed162e1ecc3ae/eng/doc/fips/README.md#build-option-to-use-go-crypto
[metadata]
category = "azl-compatibility"
upstream-status = "inapplicable"

[[overlays]]
description = "Disable systemcrypto on the CGO_ENABLED=0 static Linux cross-builds via MS_GO_NOSYSTEMCRYPTO=1 (pure-Go crypto, self-contained): Microsoft Go baseline-enables the OpenSSL backend, which cannot compile without cgo; MS_GO_NOSYSTEMCRYPTO stays valid on Go 1.27 unlike the removed GOEXPERIMENT=nosystemcrypto"
type = "spec-search-replace"
section = "%build"
regex = '^CGO_ENABLED=0 GOARCH'
replacement = "MS_GO_NOSYSTEMCRYPTO=1 CGO_ENABLED=0 GOARCH"
Comment thread
liunan-ms marked this conversation as resolved.
2 changes: 0 additions & 2 deletions base/comps/components.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -188,7 +188,6 @@ overlay-files = ["overlays/*.overlay.toml"]
[components.buildah]
[components.bullet]
[components.busybox]
[components.butane]
[components.byacc]
[components.byaccj]
[components.byte-buddy]
Expand Down Expand Up @@ -1342,7 +1341,6 @@ overlay-files = ["overlays/*.overlay.toml"]
[components.icoutils]
[components.icu]
[components.icu4j]
[components.ignition]
[components.igraph]
[components.igvm]
[components.iio-sensor-proxy]
Expand Down
1 change: 1 addition & 0 deletions base/comps/ignition/ignition.comp.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
[components.ignition]
22 changes: 22 additions & 0 deletions base/comps/ignition/overlays/0001-disable-systemcrypto-static-cross-builds.overlay.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,22 @@
# Azure Linux's golang is the Microsoft build of Go, whose systemcrypto (OpenSSL)
# backend is baseline-enabled for Linux targets. The -redistributable Linux binaries
# are cross-compiled static with CGO_ENABLED=0: the OpenSSL backend file is excluded
# (no cgo) but systemcrypto stays enabled, so no crypto backend file is selected and
# crypto/internal/backend/fips140 fails to compile (undefined systemFIPSMode/
# backendEnabled). Disable systemcrypto for these cgo-free static cross-builds so the
# pure-Go crypto implementation is used, keeping the redistributable binaries
# self-contained (no runtime OpenSSL). Use the MS_GO_NOSYSTEMCRYPTO=1 env var, not
# GOEXPERIMENT=nosystemcrypto: it is the documented, forward-compatible knob (Go 1.25.2
# through 1.27+), whereas GOEXPERIMENT=nosystemcrypto is removed and rejected in Go 1.27.
# ignition's GOEXPERIMENT= (empty) does not clear the Microsoft Go platform baseline.
# Ref: https://github.com/microsoft/go/blob/8ef6cff0f34e983fb707a455292ed162e1ecc3ae/eng/doc/fips/README.md#build-option-to-use-go-crypto
[metadata]
category = "azl-compatibility"
upstream-status = "inapplicable"

[[overlays]]
description = "Disable systemcrypto on the CGO_ENABLED=0 static Linux cross-builds via MS_GO_NOSYSTEMCRYPTO=1 (pure-Go crypto, self-contained): stays valid on Go 1.27 unlike the removed GOEXPERIMENT=nosystemcrypto; the native strictfipsruntime binary is unaffected"
type = "spec-search-replace"
section = "%build"
regex = '^GOEXPERIMENT= CGO_ENABLED=0'
replacement = "MS_GO_NOSYSTEMCRYPTO=1 GOEXPERIMENT= CGO_ENABLED=0"
Comment thread
liunan-ms marked this conversation as resolved.
2 changes: 1 addition & 1 deletion locks/butane.lock
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,5 +3,5 @@ version = 1
import-commit = '80e122caba6bafc76bb9115370bfd1d3c21fb3ea'
upstream-commit = '80e122caba6bafc76bb9115370bfd1d3c21fb3ea'
manual-bump = 2
input-fingerprint = 'sha256:9b956ec248a8160470bfc52fcf7ba2951f01a0f93412a2c57fa493c4d8706829'
input-fingerprint = 'sha256:2d345c1da17e2267ae629b501fad537d0da78895b7aff04487bbe55a07c0e36f'
resolution-input-hash = 'sha256:466421704711c4fd3c71f0b2ed715a0e61d49e3e26f3a2637fee755795849c8e'
2 changes: 1 addition & 1 deletion locks/ignition.lock
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,5 +3,5 @@ version = 1
import-commit = '8b52f0328586e49ad5a0f6b403cf032e2449e050'
upstream-commit = '8b52f0328586e49ad5a0f6b403cf032e2449e050'
manual-bump = 2
input-fingerprint = 'sha256:c2fe51adea2c92540c4de77eab58692355ddedde541eb719683ba62d276eb3a6'
input-fingerprint = 'sha256:764d0117c14900a8c8b90af8a4076410033f9b9421b87b0007b884d02eec1ca0'
resolution-input-hash = 'sha256:466421704711c4fd3c71f0b2ed715a0e61d49e3e26f3a2637fee755795849c8e'
10 changes: 5 additions & 5 deletions specs/b/butane/butane.spec
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,7 +25,7 @@ configs for provisioning operating systems that use Ignition.}
%global godocs docs README.md

Name: butane
Release: 5%{?dist}
Release: 6%{?dist}
Summary: Butane config transpiler

License: Apache-2.0
Expand Down Expand Up @@ -102,10 +102,10 @@ echo "Building butane..."
%global gocrossbuild go build -ldflags "${LDFLAGS:-} -B 0x$(head -c8 /dev/urandom|od -An -tx1|tr -d ' \\n')" -a -v -x

echo "Building Linux Butane with static linking..."
CGO_ENABLED=0 GOARCH=arm64 GOOS=linux %gocrossbuild -o butane-aarch64-unknown-linux-gnu-static internal/main.go
CGO_ENABLED=0 GOARCH=ppc64le GOOS=linux %gocrossbuild -o butane-ppc64le-unknown-linux-gnu-static internal/main.go
CGO_ENABLED=0 GOARCH=s390x GOOS=linux %gocrossbuild -o butane-s390x-unknown-linux-gnu-static internal/main.go
CGO_ENABLED=0 GOARCH=amd64 GOOS=linux %gocrossbuild -o butane-x86_64-unknown-linux-gnu-static internal/main.go
MS_GO_NOSYSTEMCRYPTO=1 CGO_ENABLED=0 GOARCH=arm64 GOOS=linux %gocrossbuild -o butane-aarch64-unknown-linux-gnu-static internal/main.go
MS_GO_NOSYSTEMCRYPTO=1 CGO_ENABLED=0 GOARCH=ppc64le GOOS=linux %gocrossbuild -o butane-ppc64le-unknown-linux-gnu-static internal/main.go
MS_GO_NOSYSTEMCRYPTO=1 CGO_ENABLED=0 GOARCH=s390x GOOS=linux %gocrossbuild -o butane-s390x-unknown-linux-gnu-static internal/main.go
MS_GO_NOSYSTEMCRYPTO=1 CGO_ENABLED=0 GOARCH=amd64 GOOS=linux %gocrossbuild -o butane-x86_64-unknown-linux-gnu-static internal/main.go

echo "Building macOS Butane..."
GOARCH=amd64 GOOS=darwin %gocrossbuild -o butane-x86_64-apple-darwin internal/main.go
Expand Down
10 changes: 5 additions & 5 deletions specs/i/ignition/ignition.spec
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,7 +25,7 @@ Version: 2.26.0
%global dracutlibdir %{_prefix}/lib/dracut

Name: ignition
Release: 4%{?dist}
Release: 5%{?dist}
Summary: First boot installer and configuration tool

# Upstream license specification: Apache-2.0
Expand Down Expand Up @@ -286,10 +286,10 @@ echo "Building ignition-validate..."

%if 0%{?fedora}
echo "Building statically-linked Linux ignition-validate..."
GOEXPERIMENT= CGO_ENABLED=0 GOARCH=arm64 GOOS=linux %gocrossbuild -o ./ignition-validate-aarch64-unknown-linux-gnu-static validate/main.go
GOEXPERIMENT= CGO_ENABLED=0 GOARCH=ppc64le GOOS=linux %gocrossbuild -o ./ignition-validate-ppc64le-unknown-linux-gnu-static validate/main.go
GOEXPERIMENT= CGO_ENABLED=0 GOARCH=s390x GOOS=linux %gocrossbuild -o ./ignition-validate-s390x-unknown-linux-gnu-static validate/main.go
GOEXPERIMENT= CGO_ENABLED=0 GOARCH=amd64 GOOS=linux %gocrossbuild -o ./ignition-validate-x86_64-unknown-linux-gnu-static validate/main.go
MS_GO_NOSYSTEMCRYPTO=1 GOEXPERIMENT= CGO_ENABLED=0 GOARCH=arm64 GOOS=linux %gocrossbuild -o ./ignition-validate-aarch64-unknown-linux-gnu-static validate/main.go
MS_GO_NOSYSTEMCRYPTO=1 GOEXPERIMENT= CGO_ENABLED=0 GOARCH=ppc64le GOOS=linux %gocrossbuild -o ./ignition-validate-ppc64le-unknown-linux-gnu-static validate/main.go
MS_GO_NOSYSTEMCRYPTO=1 GOEXPERIMENT= CGO_ENABLED=0 GOARCH=s390x GOOS=linux %gocrossbuild -o ./ignition-validate-s390x-unknown-linux-gnu-static validate/main.go
MS_GO_NOSYSTEMCRYPTO=1 GOEXPERIMENT= CGO_ENABLED=0 GOARCH=amd64 GOOS=linux %gocrossbuild -o ./ignition-validate-x86_64-unknown-linux-gnu-static validate/main.go

echo "Building macOS ignition-validate..."
GOEXPERIMENT= GOARCH=amd64 GOOS=darwin %gocrossbuild -o ./ignition-validate-x86_64-apple-darwin validate/main.go
Expand Down
Loading