Skip to content

Commit 283782f

Browse files
phlaxphlax
authored
bazel-registry: Add go-fips@1.24.12-fips.envoy (#3591)
Signed-off-by: Ryan Northey <ryan@synca.io>
1 parent c6e9843 commit 283782f

File tree

6 files changed

+235
-0
lines changed

6 files changed

+235
-0
lines changed

‎bazel-registry/modules/README.md‎

Lines changed: 155 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,155 @@
1+
# BoringSSL FIPS Module Registry
2+
3+
This directory contains bzlmod modules for building FIPS-compliant BoringSSL.
4+
5+
## Modules
6+
7+
### `go-fips` (v1.24.12-fips.envoy)
8+
9+
Provides a FIPS-capable Go runtime isolated from Bazel's Minimum Version Selection (MVS). This module is required for building and validating BoringSSL FIPS libraries.
10+
11+
**Why separate from rules_go?**
12+
- Prevents accidental version drift that could compromise FIPS compliance
13+
- Ensures consistent toolchain version across all FIPS builds
14+
- Isolated from MVS dependency resolution
15+
16+
### `boringssl-fips` (fips-20250107.envoy)
17+
18+
Provides FIPS-validated BoringSSL libraries (libcrypto.a and libssl.a) built according to the BoringCrypto security policy.
19+
20+
**Security Guarantees:**
21+
- Build-time validation is MANDATORY and ENFORCED
22+
- Users can NEVER consume unvalidated binaries
23+
- All intermediate build outputs are private
24+
- Only validated libraries are exposed via public targets
25+
26+
## Usage
27+
28+
### In your MODULE.bazel:
29+
30+
```starlark
31+
bazel_dep(name = "boringssl-fips", version = "fips-20250107.envoy")
32+
33+
# The go-fips dependency is automatically pulled in by boringssl-fips
34+
```
35+
36+
### In your BUILD file:
37+
38+
```starlark
39+
load("@rules_cc//cc:defs.bzl", "cc_binary")
40+
41+
cc_binary(
42+
name = "my_app",
43+
srcs = ["main.cc"],
44+
deps = [
45+
"@boringssl-fips//:crypto",
46+
"@boringssl-fips//:ssl",
47+
],
48+
)
49+
```
50+
51+
## Implementation Details
52+
53+
### Build Process
54+
55+
The FIPS build follows this chain:
56+
57+
1. **Private cmake build** (`_boringssl_build`)
58+
- Builds BoringSSL with `-DFIPS=1` flag
59+
- Builds both libraries and the `bssl` validation tool
60+
- Uses `rules_foreign_cc` cmake() rule
61+
- Visibility: private (not accessible to consumers)
62+
63+
2. **Private validation** (`_boringssl_validated`)
64+
- Runs `bssl isfips` to verify FIPS mode (must return "1")
65+
- Runs FIPS self-tests via `ninja run_tests`
66+
- Fails the build if validation fails
67+
- Outputs validated libraries only if tests pass
68+
- Visibility: private (not accessible to consumers)
69+
70+
3. **Public targets** (`crypto`, `ssl`)
71+
- Depend on `_boringssl_validated`
72+
- Can ONLY access validated libraries
73+
- This is the only way to consume the libraries
74+
- Visibility: public
75+
76+
### Security Model
77+
78+
**Key Property:** It is impossible to consume unvalidated binaries.
79+
80+
The build enforces this through:
81+
- Private visibility on all unvalidated targets
82+
- Validation as a required dependency of public targets
83+
- Build failure if validation fails
84+
- No escape hatches or bypass mechanisms
85+
86+
### Toolchain Requirements
87+
88+
The modules handle toolchain requirements internally:
89+
- **cmake**: Latest stable (currently 4.2.2) via `rules_foreign_cc`
90+
- **ninja**: Latest stable (currently 1.13.2) via `rules_foreign_cc`
91+
- **Go**: Version 1.24.12 via `go-fips` module
92+
- **LLVM**: Documented as dev_dependency (users should use latest stable)
93+
94+
## Compliance Notes
95+
96+
### FIPS 140-2/140-3
97+
98+
These modules use BoringSSL's `fips-20250107` branch, which targets FIPS 140-2 and 140-3 validation. The validation status depends on:
99+
- Using the exact code version provided
100+
- Following the BoringCrypto module security policy
101+
- Proper integration in your application
102+
103+
**Important:** FIPS compliance is not automatic. You must:
104+
1. Use these modules as-is (no modifications to the build)
105+
2. Ensure your application uses the libraries correctly
106+
3. Follow any additional guidance from NIST/CMVP for your use case
107+
108+
### FedRAMP Guidance
109+
110+
Per FedRAMP requirements:
111+
- Uses latest stable toolchain versions
112+
- Pinned versions prevent drift
113+
- All components are outside MVS
114+
115+
## References
116+
117+
- [BoringSSL FIPS Documentation](https://boringssl.googlesource.com/boringssl/+/refs/heads/main/crypto/fipsmodule/FIPS.md)
118+
- [Go FIPS 140-3 Support](https://go.dev/doc/security/fips140)
119+
- [Envoy FIPS Implementation](https://github.com/envoyproxy/envoy/tree/main/bazel/external)
120+
- [Tracking Issue](https://github.com/envoyproxy/toolshed/issues/3587)
121+
122+
## Platform Support
123+
124+
Currently supported platforms:
125+
- Linux x86_64 (amd64)
126+
127+
**Note:** The current implementation downloads a Linux x86_64 Go binary. For multi-platform support, the modules would need to be extended with platform-specific selections.
128+
129+
## Development
130+
131+
### Based on Envoy's Implementation
132+
133+
These modules are based on Envoy's proven WORKSPACE-based FIPS build, adapted for:
134+
- bzlmod module system instead of WORKSPACE
135+
- `rules_foreign_cc` cmake() instead of raw genrules
136+
- Standalone registry distribution
137+
138+
The validation logic and security model remain identical to Envoy's implementation.
139+
140+
### Testing
141+
142+
To test these modules:
143+
1. Enable bzlmod in your `.bazelrc`: `common --enable_bzlmod`
144+
2. Add the toolshed registry to your MODULE.bazel
145+
3. Build a target that depends on `@boringssl-fips`
146+
4. Verify the validation runs during the build
147+
148+
### Maintenance
149+
150+
When updating:
151+
- **BoringSSL version**: Update to a new `fips-YYYYMMDD` branch
152+
- **Go version**: Update to latest stable with FIPS support
153+
- **Toolchains**: Update cmake/ninja via `rules_foreign_cc` version
154+
155+
Always verify FIPS validation still passes after updates.

‎bazel-registry/modules/go-fips/1.24.12.envoy/MODULE.bazel‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
# FIPS-pinned Go runtime module
2+
#
3+
# This module provides a standalone FIPS-capable Go runtime for building and validating
4+
# BoringSSL FIPS libraries. It is intentionally kept separate from rules_go to isolate
5+
# it from Bazel's Minimum Version Selection (MVS), preventing accidental version drift
6+
# that could compromise FIPS compliance.
7+
#
8+
# This Go distribution includes native FIPS 140-3 support (Go 1.24+) via GODEBUG=fips140=on.
9+
# While the distribution itself isn't built with BoringCrypto, it can build and test
10+
# BoringSSL's FIPS module, which is the intended use case.
11+
#
12+
# FedRAMP Guidance: Use latest stable Go version
13+
#
14+
# Reference: https://go.dev/doc/security/fips140
15+
#
16+
module(
17+
name = "go-fips",
18+
version = "1.24.12.envoy",
19+
bazel_compatibility = [">=7.2.1"],
20+
compatibility_level = 1,
21+
)
22+
23+
bazel_dep(name = "platforms", version = "0.0.11")

‎bazel-registry/modules/go-fips/1.24.12.envoy/overlay/BUILD.bazel‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
package(default_visibility = ["//visibility:public"])
2+
3+
exports_files([
4+
"bin/go",
5+
"bin/gofmt",
6+
])
7+
8+
filegroup(
9+
name = "go_sdk",
10+
srcs = glob(
11+
["**"],
12+
exclude = ["**/test/**"],
13+
),
14+
)
15+
16+
filegroup(
17+
name = "go",
18+
srcs = ["bin/go"],
19+
)

‎bazel-registry/modules/go-fips/1.24.12.envoy/presubmit.yml‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
matrix:
2+
platform:
3+
- ubuntu2204
4+
bazel:
5+
- 8.x
6+
- 7.x
7+
tasks:
8+
verify_targets:
9+
name: Verify build targets
10+
platform: ${{ platform }}
11+
bazel: ${{ bazel }}
12+
build_targets:
13+
- '@go-fips//:go'

‎bazel-registry/modules/go-fips/1.24.12.envoy/source.json‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
{
2+
"url": "https://go.dev/dl/go1.24.12.linux-amd64.tar.gz",
3+
"integrity": "sha256-vd+OZTyCQprqeuwlIHdOeZJdS7kp/iDmfswA3Vr0TFA=",
4+
"strip_prefix": "go",
5+
"overlay": {
6+
"BUILD.bazel": "sha256-J5gQIVS+kz563PCC3APnSRtYup4/h353LiAq6rGVGag="
7+
}
8+
}

‎bazel-registry/modules/go-fips/metadata.json‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
{
2+
"homepage": "https://go.dev",
3+
"maintainers": [
4+
{
5+
"email": "maintainers@envoyproxy.io",
6+
"github": "envoyproxy",
7+
"name": "Envoy Proxy Maintainers"
8+
}
9+
],
10+
"repository": [
11+
"github:golang/go"
12+
],
13+
"versions": [
14+
"1.24.12.envoy"
15+
],
16+
"yanked_versions": {}
17+
}

0 commit comments

Comments
 (0)