test

.github/workflows/otelcol-fips.yml

@@ -0,0 +1,27 @@
+name: "otelcol-fips"
+
+on:
+  push:
+    branches:
+      - otelcol-fips
+
+concurrency:
+  group: otelcol-fips-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  otelcol-fips:
+    runs-on: ${{ fromJSON('["ubuntu-22.04", "otel-arm64"]')[matrix.ARCH == 'arm64'] }}
+    strategy:
+      matrix:
+        ARCH: [ "amd64", "arm64" ]
+      fail-fast: false
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - run: make otelcol-fips ARCH=${{ matrix.ARCH }}
+      - uses: actions/upload-artifact@v4
+        with:
+          name: otelcol-fips-${{ matrix.ARCH }}
+          path: ./bin/otelcol_linux_${{ matrix.ARCH }}_fips

Makefile

@@ -30,6 +30,7 @@ BUILD_X1=-X $(BUILD_INFO_IMPORT_PATH).Version=$(VERSION)
 BUILD_X2=-X $(BUILD_INFO_IMPORT_PATH_CORE).Version=$(VERSION)
 BUILD_INFO=-ldflags "${BUILD_X1} ${BUILD_X2}"
 BUILD_INFO_TESTS=-ldflags "-X $(BUILD_INFO_IMPORT_PATH_TESTS).Version=$(VERSION)"
+CGO_ENABLED?=0
 
 JMX_METRIC_GATHERER_RELEASE=$(shell cat internal/buildscripts/packaging/jmx-metric-gatherer-release.txt)
 SKIP_COMPILE=false
@@ -127,7 +128,7 @@ generate-metrics:
 .PHONY: otelcol
 otelcol:
 	go generate ./...
-	GO111MODULE=on CGO_ENABLED=0 go build -trimpath -o ./bin/otelcol_$(GOOS)_$(GOARCH)$(EXTENSION) $(BUILD_INFO) ./cmd/otelcol
+	GO111MODULE=on CGO_ENABLED=$(CGO_ENABLED) go build -trimpath -o ./bin/otelcol_$(GOOS)_$(GOARCH)$(EXTENSION) $(BUILD_INFO) ./cmd/otelcol
 	ln -sf otelcol_$(GOOS)_$(GOARCH)$(EXTENSION) ./bin/otelcol
 
 .PHONY: migratecheckpoint
@@ -224,3 +225,9 @@ install-test-tools:
 .PHONY: integration-test-split
 integration-test-split: install-test-tools
 	@set -e; cd tests && gotesplit --total=$(GOTESPLIT_TOTAL) --index=$(GOTESPLIT_INDEX) ./... -- -p 1 $(BUILD_INFO_TESTS) --tags=integration -v -timeout 5m -count 1
+
+.PHONY: otelcol-fips
+otelcol-fips:
+	DOCKER_REPO=$(DOCKER_REPO) ARCH=$(ARCH) VERSION=$(VERSION) ./internal/buildscripts/packaging/otelcol-fips.sh
+	cd ./internal/tools && go install github.com/acardace/fips-detect
+	fips-detect ./bin/otelcol_linux_${ARCH}_fips

cmd/otelcol/Dockerfile.fips

@@ -0,0 +1,14 @@
+ARG DOCKER_REPO=docker.io
+
+FROM ${DOCKER_REPO}/golang:1.21.11 as build
+ARG TARGETARCH
+ARG VERSION
+WORKDIR /src
+COPY go.mod /src/go.mod
+COPY go.sum /src/go.sum
+COPY cmd/otelcol /src/cmd/otelcol
+COPY internal /src/internal
+COPY pkg /src/pkg
+COPY Makefile /src/Makefile
+COPY Makefile.Common /src/Makefile.Common
+RUN GOOS=linux GOARCH=${TARGETARCH} GOEXPERIMENT=boringcrypto CGO_ENABLED=1 EXTENSION=_fips make otelcol VERSION=$VERSION

internal/buildscripts/packaging/otelcol-fips.sh

@@ -0,0 +1,21 @@
+#!/bin/bash
+
+set -euo pipefail
+
+SCRIPT_DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
+REPO_DIR="$( cd ${SCRIPT_DIR}/../../../ && pwd )"
+
+DOCKER_REPO=${DOCKER_REPO:-docker.io}
+ARCH=${ARCH:-amd64}
+VERSION=${VERSION:-}
+
+trap "docker rm -f otelcol-fips >/dev/null" EXIT
+
+docker build --platform=linux/${ARCH} \
+    --build-arg DOCKER_REPO=${DOCKER_REPO} \
+    --build-arg VERSION=${VERSION} \
+    --tag otelcol-fips:${ARCH} \
+    -f ${REPO_DIR}/cmd/otelcol/Dockerfile.fips $REPO_DIR
+docker rm -f otelcol-fips >/dev/null 2>&1 || true
+docker create --name otelcol-fips otelcol-fips:${ARCH}
+docker cp otelcol-fips:/src/bin/otelcol_linux_${ARCH}_fips ${REPO_DIR}/bin/otelcol_linux_${ARCH}_fips

internal/tools/go.mod

@@ -5,6 +5,7 @@ go 1.21.0
 toolchain go1.21.11
 
 require (
+	github.com/acardace/fips-detect v0.0.0-20230309083406-7157dae5bafd
 	github.com/client9/misspell v0.3.4
 	github.com/golangci/golangci-lint v1.59.1
 	github.com/google/addlicense v1.1.1
@@ -54,6 +55,7 @@ require (
 	github.com/charithe/durationcheck v0.0.10 // indirect
 	github.com/chavacava/garif v0.1.0 // indirect
 	github.com/ckaznocha/intrange v0.1.2 // indirect
+	github.com/coreos/pkg v0.0.0-20180928190104-399ea9e2e55f // indirect
 	github.com/curioswitch/go-reassign v0.2.0 // indirect
 	github.com/daixiang0/gci v0.13.4 // indirect
 	github.com/davecgh/go-spew v1.1.1 // indirect