Build fips binaries in Docker

.github/workflows/fips.yaml

@@ -26,12 +26,20 @@ env:
   GOPROXY: https://proxy.golang.org
 
 jobs:
-  fips:
+  build:
     runs-on: ubuntu-latest
+    env:
+      BUILD_FIPS_IN_DOCKER: true
     steps:
       - uses: actions/checkout@v4
       - uses: actions/setup-go@v5
         with:
           go-version-file: go.mod
+      - uses: docker/setup-qemu-action@v3
+        with:
+          platforms: amd64,arm64
+      # Whitelist the directory where the source code will be mounted in the container
+      # used to build teh FIPS binaries
+      - run: git config --global --add safe.directory /opt/src
       - run: make fips
       - run: make docker-fips

.github/workflows/publish.yaml

@@ -25,6 +25,8 @@ env:
 jobs:
   publish:
     runs-on: ubuntu-latest
+    env:
+      BUILD_FIPS_IN_DOCKER: true
     steps:
       - name: "Set release tag"
         if: ${{ github.ref_type == 'tag' }}
@@ -37,15 +39,19 @@ jobs:
       - uses: actions/setup-go@v5
         with:
           go-version-file: go.mod
-
-      - run: make check
-
       - uses: docker/login-action@v3
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
+      - uses: docker/setup-qemu-action@v3
+        with:
+          platforms: amd64,arm64
+      # Whitelist the directory where the source code will be mounted in the container
+      # used to build teh FIPS binaries
+      - run: git config --global --add safe.directory /opt/src
 
+      - run: make check
       - run: make docker-push
       - run: make docker-push-fips
 

Makefile

@@ -55,7 +55,7 @@ $(OUTDIR)/$(NAME)-static-%: $(OUTDIR)
 $(OUTDIR)/$(NAME)-fips-%: GOOS=$(word 1,$(subst -, ,$(subst $(NAME)-fips-,,$(@F))))
 $(OUTDIR)/$(NAME)-fips-%: GOARCH=$(word 2,$(subst -, ,$(subst $(NAME)-fips-,,$(@F))))
 $(OUTDIR)/$(NAME)-fips-%: $(OUTDIR)
-ifneq ($(OS),Darwin)
+ifneq ($(BUILD_FIPS_IN_DOCKER),true)
 	@echo "Build $(@F)"
 	@GOEXPERIMENT=boringcrypto CGO_ENABLED=1 GOOS=$(GOOS) GOARCH=$(GOARCH) go build $(BUILD_OPTS) \
 		-ldflags '-linkmode=external -s -w -extldflags "-static"' -tags "netgo" \

env.mk

@@ -40,6 +40,10 @@ DOCKER_TAG ?= $(shell git rev-parse HEAD)
 endif
 
 OS := $(shell uname)
+ifeq ($(OS),Darwin)
+BUILD_FIPS_IN_DOCKER ?= true
+endif
+
 export ARCH := $(shell uname -m)
 ifeq ($(ARCH),x86_64)
 export ARCH := amd64

run-in-docker.sh

@@ -24,17 +24,17 @@ fi
 
 set -e
 
-ROOT=$(git rev-parse --show-toplevel)
+ROOT=$(dirname "${0}")
 GO_VERSION=$(sed -ne 's/^go //gp' "${ROOT}/go.mod")
 BUILD_IMAGE="golang:${GO_VERSION}"
 
 docker run \
     --rm \
     --platform "${1}" \
-    -v "${PWD}":/source \
+    -v "${PWD}":/opt/src \
     -v "$(go env GOMODCACHE)":/go/pkg/mod \
     -e GOPROXY="$(go env GOPROXY)" \
     -e GOPRIVATE="$(go env GOPRIVATE)" \
-    -w /source \
+    -w /opt/src \
     "${BUILD_IMAGE}" \
     /bin/bash -c "${*:2}"