[8.19](backport #43840) Add FIPS indicator to startup and version command

libbeat/beat/info.go

@@ -28,18 +28,19 @@ import (
 
 // Info stores a beats instance meta data.
 type Info struct {
-	Beat            string    // The actual beat's name
-	IndexPrefix     string    // The beat's index prefix in Elasticsearch.
-	Version         string    // The beat version. Defaults to the libbeat version when an implementation does not set a version
-	ElasticLicensed bool      // Whether the beat is licensed under and Elastic License
-	Name            string    // configured beat name
-	Hostname        string    // hostname
-	FQDN            string    // FQDN
-	ID              uuid.UUID // ID assigned to beat machine
-	EphemeralID     uuid.UUID // ID assigned to beat process invocation (PID)
-	FirstStart      time.Time // The time of the first start of the Beat.
-	StartTime       time.Time // The time of last start of the Beat. Updated when the Beat is started or restarted.
-	UserAgent       string    // A string of the user-agent that can be passed to any outputs or network connections
+	Beat             string    // The actual beat's name
+	IndexPrefix      string    // The beat's index prefix in Elasticsearch.
+	Version          string    // The beat version. Defaults to the libbeat version when an implementation does not set a version
+	ElasticLicensed  bool      // Whether the beat is licensed under and Elastic License
+	Name             string    // configured beat name
+	Hostname         string    // hostname
+	FQDN             string    // FQDN
+	ID               uuid.UUID // ID assigned to beat machine
+	EphemeralID      uuid.UUID // ID assigned to beat process invocation (PID)
+	FirstStart       time.Time // The time of the first start of the Beat.
+	StartTime        time.Time // The time of last start of the Beat. Updated when the Beat is started or restarted.
+	UserAgent        string    // A string of the user-agent that can be passed to any outputs or network connections
+	FIPSDistribution bool      // If the beat was compiled as a FIPS distribution.
 
 	// Monitoring-related fields
 	Monitoring           Monitoring

libbeat/cmd/instance/beat.go

@@ -244,16 +244,17 @@
 
 	b := beat.Beat{
 		Info: beat.Info{
-			Beat:            name,
-			ElasticLicensed: elasticLicensed,
-			IndexPrefix:     indexPrefix,
-			Version:         v,
-			Name:            hostname,
-			Hostname:        hostname,
-			ID:              id,
-			FirstStart:      time.Now(),
-			StartTime:       time.Now(),
-			EphemeralID:     metricreport.EphemeralID(),
+			Beat:             name,
+			ElasticLicensed:  elasticLicensed,
+			IndexPrefix:      indexPrefix,
+			Version:          v,
+			Name:             hostname,
+			Hostname:         hostname,
+			ID:               id,
+			FirstStart:       time.Now(),
+			StartTime:        time.Now(),
+			EphemeralID:      metricreport.EphemeralID(),
+			FIPSDistribution: version.FIPSDistribution,
 		},
 		Fields:   fields,
 		Registry: reload.NewRegistry(),
@@ -313,7 +314,7 @@
 		config.OverwriteConfigOpts(configOptsWithKeystore(store))
 	}
 
 	b.Beat.Info.Monitoring.Namespace = monitoring.GetNamespace(b.Info.Beat + "-" + b.Info.ID.String())
 
 	b.Info.Monitoring.SetupRegistries()
 
@@ -321,7 +322,7 @@
 	if err != nil {
 		return nil, fmt.Errorf("error setting up instrumentation: %w", err)
 	}
 	b.Beat.Instrumentation = instrumentation
 
 	b.keystore = store
 	b.Beat.Keystore = store
@@ -349,7 +350,7 @@
 		return nil, fmt.Errorf("error unpacking beats logging config: %w\n%v", err, b.Config.Logging)
 	}
 
 	if err := logp.ConfigureWithCore(logpConfig, core); err != nil {
 		return nil, fmt.Errorf("error configuring beats logp: %w", err)
 	}
 
@@ -439,7 +440,7 @@
 	if imFactory == nil {
 		imFactory = idxmgmt.MakeDefaultSupport(settings.ILM)
 	}
 	b.IdxSupporter, err = imFactory(nil, b.Beat.Info, b.RawConfig)
 	if err != nil {
 		return nil, fmt.Errorf("error setting index supporter: %w", err)
 	}
@@ -553,7 +554,7 @@
 	}
 
 	log := logp.NewLogger("beat")
-	log.Infof("Setup Beat: %s; Version: %s", b.Info.Beat, b.Info.Version)
+	log.Infof("Setup Beat: %s; Version: %s (FIPS-distribution: %v)", b.Info.Beat, b.Info.Version, b.Info.FIPSDistribution)
 	b.logSystemInfo(log)
 
 	err = b.registerESVersionCheckCallback()
@@ -1038,7 +1039,7 @@
 		return fmt.Errorf("error setting timestamp precision: %w", err)
 	}
 
 	if err := configure.LoggingWithTypedOutputs(b.Info.Beat, b.Config.Logging, b.Config.EventLogging, logp.TypeKey, logp.EventType); err != nil {
 		return fmt.Errorf("error initializing logging: %w", err)
 	}
 
@@ -1176,7 +1177,7 @@
 
 	if err == nil {
 		m := meta{}
 		if err := json.NewDecoder(f).Decode(&m); err != nil && err != io.EOF { //nolint:errorlint // keep old behaviour
 			f.Close()
 			return fmt.Errorf("Beat meta file reading error: %w", err)
 		}
@@ -1458,7 +1459,7 @@
 
 	// Watch for file changes while the Beat is alive
 	go func() {
 		//nolint:staticcheck // this is an endless function
 		ticker := time.Tick(extendedTLSCfg.Reload.Period)
 
 		for {

libbeat/cmd/version.go

@@ -37,16 +37,16 @@
 			func(_ *cobra.Command, args []string) error {
 				beat, err := instance.NewBeat(settings.Name, settings.IndexPrefix, settings.Version, settings.ElasticLicensed, settings.Initialize)
 				if err != nil {
 					return fmt.Errorf("error initializing beat: %s", err)
 				}
 
 				buildTime := "unknown"
 				if bt := version.BuildTime(); !bt.IsZero() {
 					buildTime = bt.String()
 				}
-				fmt.Printf("%s version %s (%s), libbeat %s [%s built %s]\n",
+				fmt.Printf("%s version %s (%s), libbeat %s [%s built %s] (FIPS-distribution: %v)\n",
 					beat.Info.Beat, beat.Info.Version, runtime.GOARCH, version.GetDefaultVersion(),
-					version.Commit(), buildTime)
+					version.Commit(), buildTime, version.FIPSDistribution)
 				return nil
 			}),
 	}

libbeat/version/fips.go

@@ -0,0 +1,23 @@
+// Licensed to Elasticsearch B.V. under one or more contributor
+// license agreements. See the NOTICE file distributed with
+// this work for additional information regarding copyright
+// ownership. Elasticsearch B.V. licenses this file to you under
+// the Apache License, Version 2.0 (the "License"); you may
+// not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+//go:build requirefips
+
+package version
+
+// Set FIPSDistribution to true for FIPS builds.
+const FIPSDistribution bool = true

libbeat/version/nofips.go

@@ -0,0 +1,23 @@
+// Licensed to Elasticsearch B.V. under one or more contributor
+// license agreements. See the NOTICE file distributed with
+// this work for additional information regarding copyright
+// ownership. Elasticsearch B.V. licenses this file to you under
+// the Apache License, Version 2.0 (the "License"); you may
+// not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+//go:build !requirefips
+
+package version
+
+// Set FIPSDistribution to false for non-FIPS builds.
+const FIPSDistribution bool = false