Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Remove further unused fips infrastructure #27900

Merged
merged 3 commits into from
Jun 20, 2023
Merged

Remove further unused fips infrastructure #27900

merged 3 commits into from
Jun 20, 2023

Conversation

wadells
Copy link
Contributor

@wadells wadells commented Jun 15, 2023 •
edited
Loading

This patch remove the buildbox-fips publishing pipeline, and fixes an issue seen in teleport.e fips builds caused by using buildbox-fips instead of buildbox-centos7-fips.

Context: I missed a couple items in #26859, as these were not caught by any pre-merge checks. This resulted in some post-merge pipelines failing, as seen here:

This supercedes #27879

Contributes to #26856

Testing Done

I hacked up a branch to run the buildboxes pipeline on push:

https://drone.platform.teleport.sh/gravitational/teleport/25253

Its green!

@wadells wadells requested review from tcsc and jakule June 15, 2023 18:14
@wadells wadells mentioned this pull request Jun 15, 2023
Closed
@wadells wadells marked this pull request as ready for review June 15, 2023 19:13
@wadells
Remove Dockerfile-arm-fips
c7ca5bb 
We don't build fips for arm, as documented in
#10581.
@wadells
Stop building buildbox-fips
5de613c 
We do not use this buildbox for anything. This step is failing because
the supporting infrastructure for buildbox-fips was removed in
#26859.
@wadells
Fix fips buildbox
f82b5ec 
BUILDBOX_FIPS was removed, replaced by BUILDBOX_CENTOS7_FIPS.
Unfortunately I missed updating this target in #26859.
This subsequently broke e CI.
@wadells wadells requested a review from fheinecke June 16, 2023 17:18
codingllama
codingllama approved these changes Jun 16, 2023
View reviewed changes
Copy link
Contributor

@codingllama codingllama left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks reasonable to me, ship it.

@wadells wadells added this pull request to the merge queue Jun 20, 2023
Merged via the queue into master with commit 6ef1186 Jun 20, 2023
@wadells wadells deleted the walt/more-fips-cleanup branch June 20, 2023 15:40
@camscale
Copy link
Contributor

A belated follow-up - it looks like the release-fips target does not work. Changing the buildbox to a centos7 one requires running with /usr/bin/scl enable $(DEVTOOLSET) I think. Without that, the following error is emitted during the build.

tar --sort=name --owner=root:0 --group=root:0 --mtime='UTC 2015-03-02' --format=gnu -c teleport-ent | gzip -n > teleport-ent-v14.0.0-dev-linux-amd64-fips-bin.tar.gz
tar: unrecognized option '--sort=name'

This error does not occur with the release-centos7-fips target and the only difference there is it does use scl. I suspect we no longer need the release-fips target - it looks like nothing in CI or the Makefiles call it from what I can tell. I think we should probably remove it, or just make it chain to release-centos7-fips perhaps. i will see if I can circle back here after getting the builds moved to GHA.

@wadells
Copy link
Contributor Author

wadells commented Aug 25, 2023

I suspect we no longer need the release-fips target - it looks like nothing in CI or the Makefiles call it from what I can tell.

I suspected this as well, but I was trying to be conservative in my changes. I'd be fine removing release-fipsentirely.

gzdunek pushed a commit that referenced this pull request Sep 21, 2023
@wadells @gzdunek
Remove further unused fips infrastructure (#27900)
990717d 
* Remove Dockerfile-arm-fips

We don't build fips for arm, as documented in
#10581.

* Stop building buildbox-fips

We do not use this buildbox for anything. This step is failing because
the supporting infrastructure for buildbox-fips was removed in
#26859.

* Fix fips buildbox

BUILDBOX_FIPS was removed, replaced by BUILDBOX_CENTOS7_FIPS.
Unfortunately I missed updating this target in #26859.
This subsequently broke e CI.

(cherry picked from commit 6ef1186)
gzdunek pushed a commit that referenced this pull request Sep 21, 2023
@wadells @gzdunek
Remove further unused fips infrastructure (#27900)
262049b 
* Remove Dockerfile-arm-fips

We don't build fips for arm, as documented in
#10581.

* Stop building buildbox-fips

We do not use this buildbox for anything. This step is failing because
the supporting infrastructure for buildbox-fips was removed in
#26859.

* Fix fips buildbox

BUILDBOX_FIPS was removed, replaced by BUILDBOX_CENTOS7_FIPS.
Unfortunately I missed updating this target in #26859.
This subsequently broke e CI.

(cherry picked from commit 6ef1186)
gzdunek pushed a commit that referenced this pull request Sep 26, 2023
@wadells @gzdunek
Remove further unused fips infrastructure (#27900)
366ed90 
* Remove Dockerfile-arm-fips

We don't build fips for arm, as documented in
#10581.

* Stop building buildbox-fips

We do not use this buildbox for anything. This step is failing because
the supporting infrastructure for buildbox-fips was removed in
#26859.

* Fix fips buildbox

BUILDBOX_FIPS was removed, replaced by BUILDBOX_CENTOS7_FIPS.
Unfortunately I missed updating this target in #26859.
This subsequently broke e CI.

(cherry picked from commit 6ef1186)
gzdunek pushed a commit that referenced this pull request Sep 26, 2023
@wadells @gzdunek
Remove further unused fips infrastructure (#27900)
73de7ac 
* Remove Dockerfile-arm-fips

We don't build fips for arm, as documented in
#10581.

* Stop building buildbox-fips

We do not use this buildbox for anything. This step is failing because
the supporting infrastructure for buildbox-fips was removed in
#26859.

* Fix fips buildbox

BUILDBOX_FIPS was removed, replaced by BUILDBOX_CENTOS7_FIPS.
Unfortunately I missed updating this target in #26859.
This subsequently broke e CI.

(cherry picked from commit 6ef1186)
This was referenced Sep 26, 2023
Merged
Merged
github-merge-queue bot pushed a commit that referenced this pull request Sep 26, 2023
@gzdunek @wadells
[v13] Remove unused FIPS infrastructure (#32539)
313b1cf 
* Remove unused FIPS build boxes (#26859)

FIPS is only built on amd64, and only on our centos:7 buildboxes.  These
other dockerfiles and targets are vestigial.  Furthermore, the buildbox
is a security risk, as ubuntu:18.04 is not supported after 2023-05-31.

If/when we want to support FIPS on ARM, we can build off the centos:7
infrastructure, or its successor.

(cherry picked from commit fafa16a)

* Remove further unused fips infrastructure (#27900)

* Remove Dockerfile-arm-fips

We don't build fips for arm, as documented in
#10581.

* Stop building buildbox-fips

We do not use this buildbox for anything. This step is failing because
the supporting infrastructure for buildbox-fips was removed in
#26859.

* Fix fips buildbox

BUILDBOX_FIPS was removed, replaced by BUILDBOX_CENTOS7_FIPS.
Unfortunately I missed updating this target in #26859.
This subsequently broke e CI.

(cherry picked from commit 6ef1186)

* Update signature

---------

Co-authored-by: Walt <walt@goteleport.com>
github-merge-queue bot pushed a commit that referenced this pull request Sep 26, 2023
@gzdunek @wadells
[v12] Remove unused FIPS infrastructure (#32540)
5fe14d6 
* Remove unused FIPS build boxes (#26859)

FIPS is only built on amd64, and only on our centos:7 buildboxes.  These
other dockerfiles and targets are vestigial.  Furthermore, the buildbox
is a security risk, as ubuntu:18.04 is not supported after 2023-05-31.

If/when we want to support FIPS on ARM, we can build off the centos:7
infrastructure, or its successor.

(cherry picked from commit fafa16a)

* Remove further unused fips infrastructure (#27900)

* Remove Dockerfile-arm-fips

We don't build fips for arm, as documented in
#10581.

* Stop building buildbox-fips

We do not use this buildbox for anything. This step is failing because
the supporting infrastructure for buildbox-fips was removed in
#26859.

* Fix fips buildbox

BUILDBOX_FIPS was removed, replaced by BUILDBOX_CENTOS7_FIPS.
Unfortunately I missed updating this target in #26859.
This subsequently broke e CI.

(cherry picked from commit 6ef1186)

* Update signature

---------

Co-authored-by: Walt <walt@goteleport.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@fheinecke fheinecke fheinecke approved these changes

@codingllama codingllama codingllama approved these changes

@tigrato tigrato tigrato approved these changes

@mdwn mdwn mdwn approved these changes

Assignees
No one assigned
Labels
size/sm
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
6 participants
@wadells @camscale @mdwn @tigrato @codingllama @fheinecke