Skip to content

Commit

Permalink
Remove custom BoringSSL build
Browse files Browse the repository at this point in the history 
The `boring` crate will compile BoringSSL on demand.

Remove unneeded Clang 7 build and replace Clang 10 with Clang 12.
BoringSSL in FIPS mode explicitly requires Clang 12.0.0, while libbpf
and related tools only require Clang 10+, so standardized everything
on Clang 12.0.0 so that we don't need multiple Clang installations.

This also required libbpf to be bumped, as 1.0.1 no longer compiled.
Both 1.1.x and 1.2.x seem to build fine, so went ahead and bumped to
1.2.2 (latest libbpf). As a result, `aquasecurity/libbpfgo` was also
bumped to match the new version.

Additionally, add a few missing git commit hash validations that were
noticed as all the `Dockerfile`s were being reviewed/updated.
  • Loading branch information
@reedloden
reedloden committed Oct 29, 2023
1 parent 8370b3a commit 365d6f5
Show file tree
Hide file tree
Showing 16 changed files with 249 additions and 184 deletions.
16 changes: 16 additions & 0 deletions .github/workflows/build-centos7-assets.yaml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,13 @@ run-name: Build CentOS 7 Buildbox Assets Images
on:
# Only allow manual triggers
workflow_dispatch:
# Temporary addition to workaround ARC invocation bug
push:
paths:
- .github/workflows/build-centos7-assets.yaml
- build.assets/Dockerfile-centos7-assets
branches:
- reed/upgrade-boringssl

env:
REGISTRY: ghcr.io
Expand All @@ -17,6 +24,7 @@ jobs:
runner: [ ubuntu-22.04-32core, ['self-hosted', 'linux', 'arm64'] ]
# Use bigger worker. Clang takes a while to build.
runs-on: ${{ matrix.runner }}
timeout-minutes: 720

permissions:
contents: read
Expand All @@ -36,6 +44,14 @@ jobs:
username: ${{ github.actor }}
password: ${{ secrets.GITHUB_TOKEN }}

- name: Ensure required packages are installed
run: |
os_id=$(awk -F= '/^ID/{print $2}' /etc/os-release)
if [[ ! "$os_id" =~ ^ubuntu.* ]]; then
sudo dnf upgrade-minimal -y
sudo dnf install -y make
fi
# We need to keep env vars in sync, so, we can't use standard build actions
- name: Build buildbox assets image
run: cd build.assets && make build-centos7-assets
Expand Down
12 changes: 8 additions & 4 deletions build.assets/Dockerfile
View file
Original file line number Diff line number Diff line change
@@ -1,3 +1,5 @@
# syntax=docker/dockerfile:1

###################################################################################
# #
# DO NOT USE FOR PRODUCTION BUILD OR ANYTHING OTHER THAN CI TESTING! #
Expand Down Expand Up @@ -82,7 +84,7 @@ RUN mkdir -p /opt && cd /opt && \
curl -fsSL https://github.com/libbpf/libbpf/archive/refs/tags/v${LIBBPF_VERSION}.tar.gz | tar xz && \
cd /opt/libbpf-${LIBBPF_VERSION}/src && \
make && \
BUILD_STATIC_ONLY=y DESTDIR=/opt/libbpf make install
BUILD_STATIC_ONLY=y DESTDIR=/opt/libbpf make install install_uapi_headers

## BUILDBOX ###################################################################
#
Expand Down Expand Up @@ -251,9 +253,11 @@ RUN make -C /opt/pam_teleport install
ENV SOFTHSM2_PATH "/usr/lib/softhsm/libsofthsm2.so"

# Install bats.
RUN curl -fsSL https://github.com/bats-core/bats-core/archive/v1.2.1.tar.gz | tar -xz && \
cd bats-core-1.2.1 && ./install.sh /usr/local && cd .. && \
rm -r bats-core-1.2.1
RUN git clone --depth=1 https://github.com/bats-core/bats-core.git -b v1.2.1 && \

Check warning on line 256 in build.assets/Dockerfile

View check run for this annotation

Orca Security (US) / Orca Security - Infrastructure as Code

[MEDIUM] RUN Instruction Using 'cd' Instead of WORKDIR 

Details:
When using RUN command 'cd' should only be used for full path. For relative path
make use of WORKDIR command instead.

Recommendation:
Using WORKDIR to change directory
cd bats-core && \
[ "$(git rev-parse HEAD)" = 'dcaec03e32e0b152f8ef9cf14b75296cf5caeaff' ] && \
./install.sh /usr/local && cd .. && \
rm -r bats-core

# Install shellcheck.
RUN scversion='v0.9.0' && \
Expand Down
2 changes: 2 additions & 0 deletions build.assets/Dockerfile-arm
View file
Original file line number Diff line number Diff line change
@@ -1,3 +1,5 @@
# syntax=docker/dockerfile:1

# This Dockerfile is used to build Teleport on ARM only.
# We are using the official Debian 12 image as a base image
# because the final binary must be compatible with distroless
Expand Down
112 changes: 98 additions & 14 deletions build.assets/Dockerfile-centos7
View file
Original file line number Diff line number Diff line change
@@ -1,12 +1,28 @@
# syntax=docker/dockerfile:1

ARG RUST_VERSION

## GIT2 ###################################################################

# git2 packages are not available on ARM64, so we need to build it from source.
FROM centos:7 AS git2

ARG BUILDARCH
ARG TARGETARCH
ARG DEVTOOLSET

# devtoolset-12 is only in CentOS buildlogs. The rpms are unsigned since they never were
# published to the official CentOS SCL repos.
RUN if [ "${TARGETARCH}" = "arm64" ]; then export TARGETARCH="aarch64"; fi && \
cat <<EOF > /etc/yum.repos.d/${DEVTOOLSET}-build.repo
[${DEVTOOLSET}-build]
name=${DEVTOOLSET} - Build
baseurl=https://buildlogs.centos.org/c7-${DEVTOOLSET}.${TARGETARCH}/
gpgcheck=0
enabled=1
EOF

# Install required dependencies.
RUN yum groupinstall -y 'Development Tools' && \

Check warning on line 26 in build.assets/Dockerfile-centos7

View check run for this annotation

Orca Security (US) / Orca Security - Infrastructure as Code

[LOW] Yum install Without Version 

Details:
Not specifying the package version can cause failures due to unanticipated
changes in required packages

Recommendation:
The package version should always be specified when using yum install
yum install -y \
ca-certificates \
Expand All @@ -20,43 +36,63 @@ RUN yum groupinstall -y 'Development Tools' && \
yum update -y && \
yum -y install centos-release-scl-rh && \
yum install -y \
centos-release-scl \
${DEVTOOLSET}-gcc* \
${DEVTOOLSET}-make && \
centos-release-scl && \
yum clean all

# As mentioned above, these packages are unsigned.
RUN yum install --nogpgcheck -y \
${DEVTOOLSET}-gcc* \
${DEVTOOLSET}-make && \
yum clean all

RUN wget https://github.com/git/git/archive/refs/tags/v2.42.0.tar.gz && \
tar xf v2.42.0.tar.gz && \
cd git-2.42.0/ && \
RUN git clone --depth=1 https://github.com/git/git.git -b v2.42.0 && \

Check warning on line 48 in build.assets/Dockerfile-centos7

View check run for this annotation

Orca Security (US) / Orca Security - Infrastructure as Code

[MEDIUM] RUN Instruction Using 'cd' Instead of WORKDIR 

Details:
When using RUN command 'cd' should only be used for full path. For relative path
make use of WORKDIR command instead.

Recommendation:
Using WORKDIR to change directory
cd git && \
[ "$(git rev-parse HEAD)" = '43c8a30d150ecede9709c1f2527c8fba92c65f40' ] && \
scl enable ${DEVTOOLSET} "make configure && \
./configure --prefix=/usr/local && \
make -j"$(nproc)" all && \
DESTDIR=/opt/git make install"

# Create an alias to the assets image. Ref: https://github.com/docker/for-mac/issues/2155
ARG BUILDARCH
FROM ghcr.io/gravitational/teleport-buildbox-centos7-assets:teleport14-${BUILDARCH} AS teleport-buildbox-centos7-assets
FROM ghcr.io/gravitational/teleport-buildbox-centos7-assets:teleport15-${BUILDARCH} AS teleport-buildbox-centos7-assets

## LIBFIDO2 ###################################################################

# Build libfido2 separately for isolation, speed and flexibility.
FROM centos:7 AS libfido2

Check warning on line 63 in build.assets/Dockerfile-centos7

View check run for this annotation

Orca Security (US) / Orca Security - Infrastructure as Code

[MEDIUM] RUN Instruction Using 'cd' Instead of WORKDIR 

Details:
When using RUN command 'cd' should only be used for full path. For relative path
make use of WORKDIR command instead.

Recommendation:
Using WORKDIR to change directory

ARG DEVTOOLSET
ARG TARGETARCH

# devtoolset-12 is only in CentOS buildlogs. The rpms are unsigned since they never were
# published to the official CentOS SCL repos.
RUN if [ "${TARGETARCH}" = "arm64" ]; then export TARGETARCH="aarch64"; fi && \
cat <<EOF > /etc/yum.repos.d/${DEVTOOLSET}-build.repo
[${DEVTOOLSET}-build]
name=${DEVTOOLSET} - Build
baseurl=https://buildlogs.centos.org/c7-${DEVTOOLSET}.${TARGETARCH}/
gpgcheck=0
enabled=1
EOF

RUN yum groupinstall -y 'Development Tools' && \

Check warning on line 79 in build.assets/Dockerfile-centos7

View check run for this annotation

Orca Security (US) / Orca Security - Infrastructure as Code

[LOW] Yum install Without Version 

Details:
Not specifying the package version can cause failures due to unanticipated
changes in required packages

Recommendation:
The package version should always be specified when using yum install
yum install -y epel-release && \
yum install -y centos-release-scl-rh && \
yum update -y && \
yum install -y \
cmake3 \
${DEVTOOLSET}-gcc* \
git \
libudev-devel \
perl-IPC-Cmd \
zlib-devel && \
yum clean all

# As mentioned above, these packages are unsigned.
RUN yum install --nogpgcheck -y \
${DEVTOOLSET}-gcc* && \
yum clean all

# Install libudev-zero.
# libudev-zero replaces systemd's libudev.
RUN git clone --depth=1 https://github.com/illiliti/libudev-zero.git -b 1.0.3 && \

Check warning on line 98 in build.assets/Dockerfile-centos7

View check run for this annotation

Orca Security (US) / Orca Security - Infrastructure as Code

[MEDIUM] RUN Instruction Using 'cd' Instead of WORKDIR 

Details:
When using RUN command 'cd' should only be used for full path. For relative path
make use of WORKDIR command instead.

Recommendation:
Using WORKDIR to change directory
Expand Down Expand Up @@ -108,6 +144,18 @@ RUN git clone --depth=1 https://github.com/Yubico/libfido2.git -b 1.13.0 && \
FROM centos:7 AS libbpf

ARG DEVTOOLSET
ARG TARGETARCH

# devtoolset-12 is only in CentOS buildlogs. The rpms are unsigned since they never were
# published to the official CentOS SCL repos.
RUN if [ "${TARGETARCH}" = "arm64" ]; then export TARGETARCH="aarch64"; fi && \
cat <<EOF > /etc/yum.repos.d/${DEVTOOLSET}-build.repo
[${DEVTOOLSET}-build]
name=${DEVTOOLSET} - Build
baseurl=https://buildlogs.centos.org/c7-${DEVTOOLSET}.${TARGETARCH}/
gpgcheck=0
enabled=1
EOF

# Install required dependencies.
RUN yum groupinstall -y 'Development Tools' && \

Check warning on line 161 in build.assets/Dockerfile-centos7

View check run for this annotation

Orca Security (US) / Orca Security - Infrastructure as Code

[LOW] Yum install Without Version 

Details:
Not specifying the package version can cause failures due to unanticipated
changes in required packages

Recommendation:
The package version should always be specified when using yum install
Expand All @@ -116,25 +164,41 @@ RUN yum groupinstall -y 'Development Tools' && \
yum -y install centos-release-scl-rh && \
yum install -y \
centos-release-scl \
${DEVTOOLSET}-gcc* \
${DEVTOOLSET}-make \
elfutils-libelf-devel-static \
scl-utils && \
yum clean all

# As mentioned above, these packages are unsigned.
RUN yum install --nogpgcheck -y \
${DEVTOOLSET}-gcc* \
${DEVTOOLSET}-make && \
yum clean all

# Install libbpf - compile with a newer GCC. The one installed by default is not able to compile it.
# BUILD_STATIC_ONLY disables libbpf.so build as we don't need it.
ARG LIBBPF_VERSION
RUN mkdir -p /opt && cd /opt && \
curl -fsSL https://github.com/libbpf/libbpf/archive/refs/tags/v${LIBBPF_VERSION}.tar.gz | tar xz && \
cd /opt/libbpf-${LIBBPF_VERSION}/src && \
scl enable ${DEVTOOLSET} "make && BUILD_STATIC_ONLY=y DESTDIR=/opt/libbpf make install"
scl enable ${DEVTOOLSET} "make && BUILD_STATIC_ONLY=y DESTDIR=/opt/libbpf make install install_uapi_headers"

## LIBPCSCLITE #####################################################################

FROM centos:7 AS libpcsclite

ARG DEVTOOLSET
ARG TARGETARCH

# devtoolset-12 is only in CentOS buildlogs. The rpms are unsigned since they never were
# published to the official CentOS SCL repos.
RUN if [ "${TARGETARCH}" = "arm64" ]; then export TARGETARCH="aarch64"; fi && \
cat <<EOF > /etc/yum.repos.d/${DEVTOOLSET}-build.repo
[${DEVTOOLSET}-build]
name=${DEVTOOLSET} - Build
baseurl=https://buildlogs.centos.org/c7-${DEVTOOLSET}.${TARGETARCH}/
gpgcheck=0
enabled=1
EOF

# Install required dependencies.
RUN yum groupinstall -y 'Development Tools' && \

Check warning on line 204 in build.assets/Dockerfile-centos7

View check run for this annotation

Orca Security (US) / Orca Security - Infrastructure as Code

[LOW] Yum install Without Version 

Details:
Not specifying the package version can cause failures due to unanticipated
changes in required packages

Recommendation:
The package version should always be specified when using yum install
Expand All @@ -145,6 +209,10 @@ RUN yum groupinstall -y 'Development Tools' && \
libudev-devel \
scl-utils \
centos-release-scl \
yum clean all

# As mentioned above, these packages are unsigned.
RUN yum install --nogpgcheck -y \
${DEVTOOLSET}-gcc* && \
yum clean all

Expand All @@ -169,21 +237,31 @@ ENV LANGUAGE=en_US.UTF-8 \
ARG GOLANG_VERSION
ARG RUST_VERSION
ARG DEVTOOLSET
ARG TARGETARCH

ARG UID
ARG GID
RUN (groupadd ci --gid=$GID -o && useradd ci --uid=$UID --gid=$GID --create-home --shell=/bin/sh && \
mkdir -p -m0700 /var/lib/teleport && chown -R ci /var/lib/teleport)

# devtoolset-12 is only in CentOS buildlogs. The rpms are unsigned since they never were
# published to the official CentOS SCL repos.
RUN if [ "${TARGETARCH}" = "arm64" ]; then export TARGETARCH="aarch64"; fi && \
cat <<EOF > /etc/yum.repos.d/${DEVTOOLSET}-build.repo
[${DEVTOOLSET}-build]
name=${DEVTOOLSET} - Build
baseurl=https://buildlogs.centos.org/c7-${DEVTOOLSET}.${TARGETARCH}/
gpgcheck=0
enabled=1
EOF

RUN yum groupinstall -y 'Development Tools' && \
yum install -y epel-release && \
yum update -y && \
yum -y install centos-release-scl-rh && \
yum install -y \
#required by libbpf
centos-release-scl \
# required by libbpf
${DEVTOOLSET}-* \
centos-release-scl \
# required by libbpf
elfutils-libelf-devel-static \
net-tools \
Expand All @@ -199,6 +277,12 @@ RUN yum groupinstall -y 'Development Tools' && \
yum clean all && \
localedef -c -i en_US -f UTF-8 en_US.UTF-8

# As mentioned above, these packages are unsigned.
RUN yum install --nogpgcheck -y \
${DEVTOOLSET}-gcc* \
${DEVTOOLSET}-make && \
yum clean all

# Override the old git in /usr/local installed by yum. We need git 2+ on GitHub Actions.
COPY --from=git2 /opt/git /

Expand Down
38 changes: 29 additions & 9 deletions build.assets/Dockerfile-centos7-assets
View file
Original file line number Diff line number Diff line change
@@ -1,6 +1,20 @@
# syntax=docker/dockerfile:1

FROM centos:7 AS centos-devtoolset

Check warning on line 3 in build.assets/Dockerfile-centos7-assets

View check run for this annotation

Orca Security (US) / Orca Security - Infrastructure as Code

[LOW] Yum install Without Version 

Details:
Not specifying the package version can cause failures due to unanticipated
changes in required packages

Recommendation:
The package version should always be specified when using yum install

ARG DEVTOOLSET
ARG TARGETARCH

# devtoolset-12 is only in CentOS buildlogs. The rpms are unsigned since they never were
# published to the official CentOS SCL repos.
RUN if [ "${TARGETARCH}" = "arm64" ]; then export TARGETARCH="aarch64"; fi && \
cat <<EOF > /etc/yum.repos.d/${DEVTOOLSET}-build.repo
[${DEVTOOLSET}-build]
name=${DEVTOOLSET} - Build
baseurl=https://buildlogs.centos.org/c7-${DEVTOOLSET}.${TARGETARCH}/
gpgcheck=0
enabled=1
EOF

# Install required dependencies.
RUN yum groupinstall -y 'Development Tools' && \
Expand All @@ -12,10 +26,6 @@ RUN yum groupinstall -y 'Development Tools' && \
centos-release-scl \
# required by Clang/LLVM
cmake3 \
# required by libbpf and Clang
${DEVTOOLSET}-gcc* \
# required by libbpf
${DEVTOOLSET}-make \
# required by libbpf
elfutils-libelf-devel \
# required by libbpf
Expand All @@ -29,19 +39,29 @@ RUN yum groupinstall -y 'Development Tools' && \
zlib-static && \
yum clean all

# As mentioned above, these packages are unsigned.
RUN yum install --nogpgcheck -y \
${DEVTOOLSET}-gcc* \
${DEVTOOLSET}-make && \
yum clean all

# Use just created devtool image with newer GCC and Cmake
FROM centos-devtoolset as clang10
FROM centos-devtoolset as clang12

Check warning on line 49 in build.assets/Dockerfile-centos7-assets

View check run for this annotation

Orca Security (US) / Orca Security - Infrastructure as Code

[MEDIUM] RUN Instruction Using 'cd' Instead of WORKDIR 

Details:
When using RUN command 'cd' should only be used for full path. For relative path
make use of WORKDIR command instead.

Recommendation:
Using WORKDIR to change directory

ARG DEVTOOLSET

# Compile Clang 10.0.1 from source. It is needed to create BPF files.
# Centos 7 doesn't provide it as a package unfortunately.
# Compile Clang 12.0.0 from source. It is needed to create BoringSSL and BPF files.
# CentOS 7 doesn't provide it as a package unfortunately.
# This version of Clang is explicitly required for FIPS compliance when building BoringSSL.
# For more information please refer to the section 12. Guidance and Secure Operation of:
# https://csrc.nist.gov/CSRC/media/projects/cryptographic-module-validation-program/documents/security-policies/140sp4407.pdf
# LLVM_INCLUDE_BENCHMARKS must be off, otherwise compilation fails,
# CLANG_BUILD_TOOLS must be on, it builds clang binary,
# LLVM_BUILD_TOOLS must be on, it builds llvm-strip binary.
# the rest is disabled to speedup the compilation.
RUN git clone --branch llvmorg-10.0.1 --depth=1 https://github.com/llvm/llvm-project.git && \
RUN git clone --branch llvmorg-12.0.0 --depth=1 https://github.com/llvm/llvm-project.git && \
cd llvm-project/ && \
[ "$(git rev-parse HEAD)" = 'd28af7c654d8db0b68c175db5ce212d74fb5e9bc' ] && \
mkdir build && cd build/ && \
scl enable ${DEVTOOLSET} 'bash -c "cmake3 \
-DCLANG_BUILD_TOOLS=ON \
Expand All @@ -68,4 +88,4 @@ RUN git clone --branch llvmorg-10.0.1 --depth=1 https://github.com/llvm/llvm-pro
FROM scratch AS buildbox-centos7-assets

Check warning on line 88 in build.assets/Dockerfile-centos7-assets

View check run for this annotation

Orca Security (US) / Orca Security - Infrastructure as Code

[MEDIUM] Missing User Instruction 

Details:
A user should be specified in the dockerfile, otherwise the image will run as
root

Recommendation:
The 'Dockerfile' should contain the 'USER' instruction

Check warning on line 88 in build.assets/Dockerfile-centos7-assets

View check run for this annotation

Orca Security (US) / Orca Security - Infrastructure as Code

[LOW] Healthcheck Instruction Missing 

Details:
Ensure that HEALTHCHECK is being used. The HEALTHCHECK instruction tells Docker
how to test a container to check that it is still working

Recommendation:
Dockerfile should contain instruction 'HEALTHCHECK'

# Copy Clang into the final image.
COPY --from=clang10 /opt/llvm /opt/llvm/
COPY --from=clang12 /opt/llvm /opt/llvm/
Loading

0 comments on commit 365d6f5

Please sign in to comment.