Skip to content

go: use runtime FIPS instead of compile-time boringcrypto #315

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
sky1122 merged 9 commits into from
Jan 16, 2026
Merged

go: use runtime FIPS instead of compile-time boringcrypto #315

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
9 commits
Select commit Hold shift + click to select a range
1cb70a4
macros: remove Go binary checks and GOLIBC from build environment
sky1122 Jan 13, 2026
a45703d
tools: delete update aws-lc
sky1122 Jan 12, 2026
3685864
patches: delete aws-lc patches and renumbers
sky1122 Jan 12, 2026
bd3184c
configs: delete aws-lc CMake toolchain files
sky1122 Jan 13, 2026
cc3d3d3
helpers: delete aws-lc build scripts and prep-go cleanup
sky1122 Jan 13, 2026
cef665b
hashes: delete aws-lc
sky1122 Jan 13, 2026
39d3fd0
patches: delete aws-lc Go compatibility patches
sky1122 Jan 13, 2026
a1ada26
wrappers: remove musl Go tree selection
sky1122 Jan 15, 2026
d7ea7a8
Dockerfile: remove syso file integration from Go toolchains
sky1122 Jan 15, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
143 changes: 1 addition & 142 deletions Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -365,13 +365,6 @@ COPY --from=sdk-rust /usr/libexec/llvm/ /usr/

# =^..^= =^..^= =^..^= =^..^= =^..^= =^..^= =^..^= =^..^= =^..^=

# Merge the LLVM install with the rest of our toolchains and C libraries for
# later use by the AWS-LC builds.
FROM sdk-libc AS sdk-libc-llvm
COPY --from=sdk-llvm / /

# =^..^= =^..^= =^..^= =^..^= =^..^= =^..^= =^..^= =^..^= =^..^=

FROM sdk AS sdk-grub

USER root
Expand Down Expand Up @@ -497,7 +490,7 @@ RUN \

# =^..^= =^..^= =^..^= =^..^= =^..^= =^..^= =^..^= =^..^= =^..^=

FROM sdk-libc-llvm AS sdk-go-prep
FROM sdk-libc AS sdk-go-prep

# Set up the environment for building.
ENV GOOS="linux"
Expand All @@ -513,8 +506,6 @@ ENV GOARM64="v8.0,crypto"

ENV GO111MODULE="auto"

ENV AWS_LC_FIPS_VER="3.0.0"

USER root
RUN dnf -y install golang

Expand All @@ -535,15 +526,8 @@ COPY ./hashes/go-${GOMAJOR} /home/builder/hashes-go
COPY ./helpers/go/prep-go.sh ./
COPY ./patches/go-${GOMAJOR} /home/builder/patches-go

COPY ./hashes/aws-lc /home/builder/hashes-aws-lc
COPY ./patches/aws-lc /home/builder/patches-aws-lc

RUN ./prep-go.sh --go-version=${GO125VER}

WORKDIR /home/builder/aws-lc/build
COPY ./configs/aws-lc/* .
COPY ./helpers/aws-lc/* .

# =^..^= =^..^= =^..^= =^..^= =^..^= =^..^= =^..^= =^..^= =^..^=

FROM sdk-go-prep AS sdk-go-1.24-prep
Expand All @@ -558,105 +542,12 @@ COPY ./hashes/go-${GOMAJOR} /home/builder/hashes-go
COPY ./helpers/go/prep-go.sh ./
COPY ./patches/go-${GOMAJOR} /home/builder/patches-go

COPY ./hashes/aws-lc /home/builder/hashes-aws-lc
COPY ./patches/aws-lc /home/builder/patches-aws-lc

RUN ./prep-go.sh --go-version=${GO124VER}

WORKDIR /home/builder/aws-lc/build
COPY ./configs/aws-lc/* .
COPY ./helpers/aws-lc/* .

# =^..^= =^..^= =^..^= =^..^= =^..^= =^..^= =^..^= =^..^= =^..^=

FROM sdk-go-1.25-prep AS sdk-go-1.25-aws-lc-gnu-x86_64
ENV ARCH="x86_64"
ENV LIBC="gnu"
ENV TARGET="${ARCH}-bottlerocket-linux-${LIBC}"
RUN ./build-aws-lc.sh --arch="${ARCH}" --target="${TARGET}" --go-dir="${HOME}/sdk-go"

# =^..^= =^..^= =^..^= =^..^= =^..^= =^..^= =^..^= =^..^= =^..^=

FROM sdk-go-1.25-prep AS sdk-go-1.25-aws-lc-gnu-aarch64
COPY --chown=0:0 --from=sdk-go-1.25-aws-lc-gnu-x86_64 /etc/group /etc/group
ENV ARCH="aarch64"
ENV LIBC="gnu"
ENV TARGET="${ARCH}-bottlerocket-linux-${LIBC}"
RUN ./build-aws-lc.sh --arch="${ARCH}" --target="${TARGET}" --go-dir="${HOME}/sdk-go"

# =^..^= =^..^= =^..^= =^..^= =^..^= =^..^= =^..^= =^..^= =^..^=

FROM sdk-go-1.25-prep AS sdk-go-1.25-aws-lc-musl-x86_64
COPY --chown=0:0 --from=sdk-go-1.25-aws-lc-gnu-aarch64 /etc/group /etc/group
ENV ARCH="x86_64"
ENV LIBC="musl"
ENV TARGET="${ARCH}-bottlerocket-linux-${LIBC}"
RUN ./build-aws-lc.sh --arch="${ARCH}" --target="${TARGET}" --go-dir="${HOME}/sdk-go"

# =^..^= =^..^= =^..^= =^..^= =^..^= =^..^= =^..^= =^..^= =^..^=

FROM sdk-go-1.25-prep AS sdk-go-1.25-aws-lc-musl-aarch64
COPY --chown=0:0 --from=sdk-go-1.25-aws-lc-musl-x86_64 /etc/group /etc/group
ENV ARCH="aarch64"
ENV LIBC="musl"
ENV TARGET="${ARCH}-bottlerocket-linux-${LIBC}"
RUN ./build-aws-lc.sh --arch="${ARCH}" --target="${TARGET}" --go-dir="${HOME}/sdk-go"

# =^..^= =^..^= =^..^= =^..^= =^..^= =^..^= =^..^= =^..^= =^..^=

FROM sdk-go-1.24-prep AS sdk-go-1.24-aws-lc-gnu-x86_64
ENV ARCH="x86_64"
ENV LIBC="gnu"
ENV TARGET="${ARCH}-bottlerocket-linux-${LIBC}"
RUN ./build-aws-lc.sh --arch="${ARCH}" --target="${TARGET}" --go-dir="${HOME}/sdk-go"

# =^..^= =^..^= =^..^= =^..^= =^..^= =^..^= =^..^= =^..^= =^..^=

FROM sdk-go-1.24-prep AS sdk-go-1.24-aws-lc-gnu-aarch64
COPY --chown=0:0 --from=sdk-go-1.24-aws-lc-gnu-x86_64 /etc/group /etc/group
ENV ARCH="aarch64"
ENV LIBC="gnu"
ENV TARGET="${ARCH}-bottlerocket-linux-${LIBC}"
RUN ./build-aws-lc.sh --arch="${ARCH}" --target="${TARGET}" --go-dir="${HOME}/sdk-go"

# =^..^= =^..^= =^..^= =^..^= =^..^= =^..^= =^..^= =^..^= =^..^=

FROM sdk-go-1.24-prep AS sdk-go-1.24-aws-lc-musl-x86_64
COPY --chown=0:0 --from=sdk-go-1.24-aws-lc-gnu-aarch64 /etc/group /etc/group
ENV ARCH="x86_64"
ENV LIBC="musl"
ENV TARGET="${ARCH}-bottlerocket-linux-${LIBC}"
RUN ./build-aws-lc.sh --arch="${ARCH}" --target="${TARGET}" --go-dir="${HOME}/sdk-go"

# =^..^= =^..^= =^..^= =^..^= =^..^= =^..^= =^..^= =^..^= =^..^=

FROM sdk-go-1.24-prep AS sdk-go-1.24-aws-lc-musl-aarch64
COPY --chown=0:0 --from=sdk-go-1.24-aws-lc-musl-x86_64 /etc/group /etc/group
ENV ARCH="aarch64"
ENV LIBC="musl"
ENV TARGET="${ARCH}-bottlerocket-linux-${LIBC}"
RUN ./build-aws-lc.sh --arch="${ARCH}" --target="${TARGET}" --go-dir="${HOME}/sdk-go"

# =^..^= =^..^= =^..^= =^..^= =^..^= =^..^= =^..^= =^..^= =^..^=

FROM sdk-go-1.25-prep AS sdk-go-1.25

COPY --from=sdk-go-1.25-aws-lc-gnu-x86_64 \
/home/builder/aws-lc/build/goboringcrypto_linux_amd64.syso \
/home/builder/sdk-go/src/crypto/internal/boring/syso/goboringcrypto_linux_amd64.syso

COPY --from=sdk-go-1.25-aws-lc-gnu-aarch64 \
/home/builder/aws-lc/build/goboringcrypto_linux_arm64.syso \
/home/builder/sdk-go/src/crypto/internal/boring/syso/goboringcrypto_linux_arm64.syso

COPY --from=sdk-go-1.25-aws-lc-musl-x86_64 \
/home/builder/aws-lc/build/goboringcrypto_linux_amd64.syso \
/home/builder/sdk-go/src/crypto/internal/boring/syso/goboringcrypto_linux_musl_amd64.syso

COPY --from=sdk-go-1.25-aws-lc-musl-aarch64 \
/home/builder/aws-lc/build/goboringcrypto_linux_arm64.syso \
/home/builder/sdk-go/src/crypto/internal/boring/syso/goboringcrypto_linux_musl_arm64.syso

COPY ./helpers/go/build-go.sh ./

# Build Go - finally!
Expand All @@ -666,22 +557,6 @@ RUN ./build-go.sh --go-version=${GO125VER}

FROM sdk-go-1.24-prep AS sdk-go-1.24

COPY --from=sdk-go-1.24-aws-lc-gnu-x86_64 \
/home/builder/aws-lc/build/goboringcrypto_linux_amd64.syso \
/home/builder/sdk-go/src/crypto/internal/boring/syso/goboringcrypto_linux_amd64.syso

COPY --from=sdk-go-1.24-aws-lc-gnu-aarch64 \
/home/builder/aws-lc/build/goboringcrypto_linux_arm64.syso \
/home/builder/sdk-go/src/crypto/internal/boring/syso/goboringcrypto_linux_arm64.syso

COPY --from=sdk-go-1.24-aws-lc-musl-x86_64 \
/home/builder/aws-lc/build/goboringcrypto_linux_amd64.syso \
/home/builder/sdk-go/src/crypto/internal/boring/syso/goboringcrypto_linux_musl_amd64.syso

COPY --from=sdk-go-1.24-aws-lc-musl-aarch64 \
/home/builder/aws-lc/build/goboringcrypto_linux_arm64.syso \
/home/builder/sdk-go/src/crypto/internal/boring/syso/goboringcrypto_linux_musl_arm64.syso

COPY ./helpers/go/build-go.sh ./

# Build Go - finally!
Expand Down Expand Up @@ -1160,10 +1035,6 @@ COPY --chown=0:0 --from=sdk-go-1.25 \
/home/builder/sdk-go/licenses/ \
/usr/share/licenses/go-1.25/

COPY --chown=0:0 --from=sdk-go-1.25 \
/home/builder/aws-lc/LICENSE \
/usr/share/licenses/aws-lc/LICENSE

COPY --chown=0:0 --from=sdk-go-1.24 /home/builder/sdk-go/bin /usr/libexec/go-1.24/bin/
COPY --chown=0:0 --from=sdk-go-1.24 /home/builder/sdk-go/lib /usr/libexec/go-1.24/lib/
COPY --chown=0:0 --from=sdk-go-1.24 /home/builder/sdk-go/pkg /usr/libexec/go-1.24/pkg/
Expand All @@ -1174,18 +1045,6 @@ COPY --chown=0:0 --from=sdk-go-1.24 \
/home/builder/sdk-go/licenses/ \
/usr/share/licenses/go-1.24/

# Create Go trees for the different glibc and musl builds of the AWS-LC syso.
# Sync timestamps to avoid rebuilds of the Go standard library.
RUN \
for v in 1.24 1.25 ; do \
find /usr/libexec/go-${v} -type f -exec touch -r /usr/libexec/go-${v}/bin/go {} \+ && \
rsync -aq --link-dest=/usr/libexec/go-${v}/ /usr/libexec/go-${v}{,-musl}/ && \
rm /usr/libexec/go-${v}/src/crypto/internal/boring/syso/goboringcrypto_linux_musl_{arm,amd}64.syso && \
rm /usr/libexec/go-${v}-musl/src/crypto/internal/boring/syso/goboringcrypto_linux_{arm,amd}64.syso && \
mv /usr/libexec/go-${v}-musl/src/crypto/internal/boring/syso/goboringcrypto_linux_{musl_,}amd64.syso && \
mv /usr/libexec/go-${v}-musl/src/crypto/internal/boring/syso/goboringcrypto_linux_{musl_,}arm64.syso ; \
done

# "sdk-rust-tools" has our attribution generation and license scan tools.
COPY --chown=0:0 --from=sdk-rust-tools /usr/libexec/tools/ /usr/libexec/tools/
COPY --chown=0:0 --from=sdk-rust-tools /usr/share/licenses/bottlerocket-license-scan/ /usr/share/licenses/bottlerocket-license-scan/
Expand Down
13 changes: 0 additions & 13 deletions configs/aws-lc/aarch64-bottlerocket-linux-gnu.toolchain.cmake
View file
Open in desktop

This file was deleted.

13 changes: 0 additions & 13 deletions configs/aws-lc/aarch64-bottlerocket-linux-musl.toolchain.cmake
View file
Open in desktop

This file was deleted.

13 changes: 0 additions & 13 deletions configs/aws-lc/x86_64-bottlerocket-linux-gnu.toolchain.cmake
View file
Open in desktop

This file was deleted.

13 changes: 0 additions & 13 deletions configs/aws-lc/x86_64-bottlerocket-linux-musl.toolchain.cmake
View file
Open in desktop

This file was deleted.

8 changes: 0 additions & 8 deletions hashes/aws-lc
View file
Open in desktop

This file was deleted.

28 changes: 0 additions & 28 deletions helpers/aws-lc/LICENSE
View file
Open in desktop

This file was deleted.

65 changes: 0 additions & 65 deletions helpers/aws-lc/build-aws-lc.sh
View file
Open in desktop

This file was deleted.

Loading