mirror of
https://github.com/zitadel/zitadel.git
synced 2026-11-03 12:47:09 -06:00
Tim Möhlmann
c03d9f4c6e
# Which Problems Are Solved
Enable FIPS 140-3 compliant build.
# How the Problems Are Solved
- Add runtime config validation, if the FIPS flag is enabled fail the
application when a non-compliant hasher is used, or throw a warning when
a legacy verifier is used
- Add a build matrix for FIPS certified build:
- Go binary is built with `GOFIPS140=certified`
- Login container uses a separate base:
[ubi9](https://catalog.redhat.com/en/software/containers/ubi9/ubi/615bcf606feffc5384e8452e)
from redhat which provides a FIPS certified OpenSSL (used by NodeJS TLS
stack)
- Non-FIPS images where already pushed to both Github Container Registry
and Google Artifact Repository (GAR). Fips images are only pushed to the
GAR.
- Tag versions are suffixed `-fips`. So on release the following images
will be additionally available:
```
europe-docker.pkg.dev/zitadel-common/zitadel-repo/zitadel-login:vX.Y.Z-fips
europe-docker.pkg.dev/zitadel-common/zitadel-repo/zitadel:vX.Y.Z-fips-debug
europe-docker.pkg.dev/zitadel-common/zitadel-repo/zitadel:vX.Y.Z-fips
```
# Other changes
- Bumb Go toolchain. At least v1.25.10 is required for a
GOFIPS140=certified setting.
# Additional Context
- Closes https://github.com/zitadel/zitadel/issues/4335
- Build [test
run](https://github.com/zitadel/zitadel/actions/runs/27253916052)
pushing FIPS and non-FIPS images
(cherry picked from commit e94d4c3986)
104 lines
2.5 KiB
Go
104 lines
2.5 KiB
Go
package cmd
|
|
|
|
import (
|
|
"bytes"
|
|
"context"
|
|
"crypto/fips140"
|
|
_ "embed"
|
|
"errors"
|
|
"io"
|
|
"strings"
|
|
|
|
"github.com/spf13/cobra"
|
|
"github.com/spf13/viper"
|
|
|
|
"github.com/zitadel/zitadel/backend/v3/instrumentation/logging"
|
|
"github.com/zitadel/zitadel/cmd/admin"
|
|
"github.com/zitadel/zitadel/cmd/build"
|
|
"github.com/zitadel/zitadel/cmd/initialise"
|
|
"github.com/zitadel/zitadel/cmd/key"
|
|
"github.com/zitadel/zitadel/cmd/mirror"
|
|
"github.com/zitadel/zitadel/cmd/ready"
|
|
"github.com/zitadel/zitadel/cmd/setup"
|
|
"github.com/zitadel/zitadel/cmd/start"
|
|
)
|
|
|
|
var (
|
|
configFiles []string
|
|
|
|
//go:embed defaults.yaml
|
|
defaultConfig []byte
|
|
|
|
//go:embed defaults_fips.yaml
|
|
defaultFipsConfig []byte
|
|
)
|
|
|
|
func New(out io.Writer, in io.Reader, args []string, server chan<- *start.Server) *cobra.Command {
|
|
cmd := &cobra.Command{
|
|
Use: "zitadel",
|
|
Short: "The ZITADEL CLI lets you interact with ZITADEL",
|
|
Long: `The ZITADEL CLI lets you interact with ZITADEL`,
|
|
RunE: func(cmd *cobra.Command, args []string) error {
|
|
return errors.New("no additional command provided")
|
|
},
|
|
Version: build.Version(),
|
|
SilenceUsage: true,
|
|
}
|
|
|
|
viper.AutomaticEnv()
|
|
viper.SetEnvPrefix("ZITADEL")
|
|
viper.SetEnvKeyReplacer(strings.NewReplacer(".", "_"))
|
|
viper.SetConfigType("yaml")
|
|
err := loadDefaultConfig()
|
|
logging.OnError(context.Background(), err).Fatal("unable to read default config")
|
|
|
|
cobra.OnInitialize(initConfig)
|
|
cmd.PersistentFlags().StringArrayVar(&configFiles, "config", nil, "path to config file to overwrite system defaults")
|
|
|
|
cmd.AddCommand(
|
|
admin.New(), //is now deprecated, remove later on
|
|
initialise.New(),
|
|
setup.New(),
|
|
start.New(server),
|
|
start.NewStartFromInit(server),
|
|
start.NewStartFromSetup(server),
|
|
mirror.New(&configFiles),
|
|
key.New(),
|
|
ready.New(),
|
|
)
|
|
|
|
cmd.InitDefaultVersionFlag()
|
|
|
|
return cmd
|
|
}
|
|
|
|
func loadDefaultConfig() error {
|
|
return loadDefaultConfigInto(viper.GetViper())
|
|
}
|
|
|
|
func loadDefaultConfigInto(v *viper.Viper) error {
|
|
if err := v.ReadConfig(bytes.NewBuffer(defaultConfig)); err != nil {
|
|
return err
|
|
}
|
|
return mergeFipsDefaultConfig(v)
|
|
}
|
|
|
|
func mergeFipsDefaultConfig(v *viper.Viper) error {
|
|
if !fips140.Enabled() {
|
|
return nil
|
|
}
|
|
return applyFipsDefaultOverlay(v)
|
|
}
|
|
|
|
func applyFipsDefaultOverlay(v *viper.Viper) error {
|
|
return v.MergeConfig(bytes.NewBuffer(defaultFipsConfig))
|
|
}
|
|
|
|
func initConfig() {
|
|
for _, file := range configFiles {
|
|
viper.SetConfigFile(file)
|
|
err := viper.MergeInConfig()
|
|
logging.OnError(context.Background(), err).Warn("unable to read config file", "file", file)
|
|
}
|
|
}
|