Skip to content

Commit e7e8b98

Browse files
murarustefaanmurarustefaan
authored
feat: Publish FIPS versions (#21516)
This pull request introduces support for FIPS-enabled builds for the BigQuery destination plugin, including workflow updates and code changes to differentiate between standard and FIPS builds. The changes ensure that FIPS-compliant binaries are built, tested, and published through the dedicated workflow.
1 parent 9bc3522 commit e7e8b98

11 files changed

Lines changed: 264 additions & 8 deletions

File tree

‎.github/workflows/dest_bigquery.yml‎

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -68,3 +68,41 @@ jobs:
6868
BIGQUERY_PROJECT_ID: ${{ secrets.BIGQUERY_TEST_PROJECT_ID }}
6969
BIGQUERY_DATASET_ID: ${{ secrets.BIGQUERY_TEST_DATASET_ID }}
7070
BIGQUERY_DATASET_LOCATION: us-west1
71+
72+
validate-fips:
73+
timeout-minutes: 30
74+
runs-on: ubuntu-latest
75+
defaults:
76+
run:
77+
working-directory: ./plugins/destination/bigquery
78+
steps:
79+
- name: Checkout
80+
uses: actions/checkout@v4
81+
82+
- uses: actions/cache@v4
83+
with:
84+
path: |
85+
~/.cache/go-build
86+
~/go/pkg/mod
87+
key: ${{ runner.os }}-go-1.25.3-validate-plugin-fips-cache-${{ hashFiles('plugins/destination/bigquery/go.sum') }}
88+
restore-keys: |
89+
${{ runner.os }}-go-1.25.3-validate-plugin-fips-cache-destination-bigquery
90+
91+
- name: Set up Go 1.x
92+
uses: actions/setup-go@v5
93+
with:
94+
go-version-file: plugins/destination/bigquery/go.mod
95+
cache: false
96+
97+
- name: Run package command
98+
env:
99+
GOFLAGS: "-tags=fipsEnabled"
100+
run: |
101+
rm -rf docs/tables.md
102+
go run main_fips.go package -m "chore: Test FIPS" "v1.0.0" .
103+
104+
- name: Unzip package artifacts
105+
run: |
106+
unzip -o dist/plugin-bigquery-v1.0.0-linux-amd64.zip
107+
chmod +x plugin-bigquery-v1.0.0-linux-amd64
108+
./plugin-bigquery-v1.0.0-linux-amd64 --version 2>&1 | grep -E 'FIPS enabled: true'

‎.github/workflows/dest_kafka.yml‎

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -53,3 +53,41 @@ jobs:
5353
run: go build .
5454
- name: Test
5555
run: make test
56+
57+
validate-fips:
58+
timeout-minutes: 30
59+
runs-on: ubuntu-latest
60+
defaults:
61+
run:
62+
working-directory: ./plugins/destination/kafka
63+
steps:
64+
- name: Checkout
65+
uses: actions/checkout@v4
66+
67+
- uses: actions/cache@v4
68+
with:
69+
path: |
70+
~/.cache/go-build
71+
~/go/pkg/mod
72+
key: ${{ runner.os }}-go-1.25.3-validate-plugin-fips-cache-${{ hashFiles('plugins/destination/kafka/go.sum') }}
73+
restore-keys: |
74+
${{ runner.os }}-go-1.25.3-validate-plugin-fips-cache-destination-kafka
75+
76+
- name: Set up Go 1.x
77+
uses: actions/setup-go@v5
78+
with:
79+
go-version-file: plugins/destination/kafka/go.mod
80+
cache: false
81+
82+
- name: Run package command
83+
env:
84+
GOFLAGS: "-tags=fipsEnabled"
85+
run: |
86+
rm -rf docs/tables.md
87+
go run main_fips.go package -m "chore: Test FIPS" "v1.0.0" .
88+
89+
- name: Unzip package artifacts
90+
run: |
91+
unzip -o dist/plugin-kafka-v1.0.0-linux-amd64.zip
92+
chmod +x plugin-kafka-v1.0.0-linux-amd64
93+
./plugin-kafka-v1.0.0-linux-amd64 --version 2>&1 | grep -E 'FIPS enabled: true'

‎.github/workflows/dest_postgresql.yml‎

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -55,3 +55,41 @@ jobs:
5555
run: make test
5656
- name: Test CockroachDB
5757
run: make test-cockroachdb
58+
59+
validate-fips:
60+
timeout-minutes: 30
61+
runs-on: ubuntu-latest
62+
defaults:
63+
run:
64+
working-directory: ./plugins/destination/postgresql
65+
steps:
66+
- name: Checkout
67+
uses: actions/checkout@v4
68+
69+
- uses: actions/cache@v4
70+
with:
71+
path: |
72+
~/.cache/go-build
73+
~/go/pkg/mod
74+
key: ${{ runner.os }}-go-1.25.3-validate-plugin-fips-cache-${{ hashFiles('plugins/destination/postgresql/go.sum') }}
75+
restore-keys: |
76+
${{ runner.os }}-go-1.25.3-validate-plugin-fips-cache-destination-postgresql
77+
78+
- name: Set up Go 1.x
79+
uses: actions/setup-go@v5
80+
with:
81+
go-version-file: plugins/destination/postgresql/go.mod
82+
cache: false
83+
84+
- name: Run package command
85+
env:
86+
GOFLAGS: "-tags=fipsEnabled"
87+
run: |
88+
rm -rf docs/tables.md
89+
go run main_fips.go package -m "chore: Test FIPS" "v1.0.0" .
90+
91+
- name: Unzip package artifacts
92+
run: |
93+
unzip -o dist/plugin-postgresql-v1.0.0-linux-amd64.zip
94+
chmod +x plugin-postgresql-v1.0.0-linux-amd64
95+
./plugin-postgresql-v1.0.0-linux-amd64 --version 2>&1 | grep -E 'FIPS enabled: true'

‎.github/workflows/publish_plugin_to_hub_fips.yml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,9 @@ on:
33
push:
44
tags:
55
- "plugins-source-test-v*.*.*"
6+
- "plugins-destination-bigquery-v*.*.*"
7+
- "plugins-destination-kafka-v*.*.*"
8+
- "plugins-destination-postgresql-v*.*.*"
69
permissions:
710
contents: read
811

‎plugins/destination/bigquery/main.go‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,5 @@
1+
//go:build !fipsEnabled
2+
13
package main
24

35
import (
@@ -12,6 +14,7 @@ import (
1214

1315
func main() {
1416
p := plugin.NewPlugin(internalPlugin.Name, internalPlugin.Version, client.New,
17+
plugin.WithBuildTargets(plugin.DefaultBuildTargets),
1518
plugin.WithKind(internalPlugin.Kind),
1619
plugin.WithTeam(internalPlugin.Team),
1720
plugin.WithJSONSchema(client.JSONSchema),

‎plugins/destination/bigquery/main_fips.go‎

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
//go:build fipsEnabled
2+
3+
//go:debug fips140=on
4+
5+
package main
6+
7+
import (
8+
"context"
9+
"crypto/fips140"
10+
"log"
11+
12+
"github.com/cloudquery/cloudquery/plugins/destination/bigquery/v4/client"
13+
internalPlugin "github.com/cloudquery/cloudquery/plugins/destination/bigquery/v4/resources/plugin"
14+
"github.com/cloudquery/plugin-sdk/v4/plugin"
15+
"github.com/cloudquery/plugin-sdk/v4/serve"
16+
)
17+
18+
func main() {
19+
log.Printf("FIPS enabled: %t", fips140.Enabled())
20+
21+
p := plugin.NewPlugin(internalPlugin.Name, internalPlugin.Version, client.New,
22+
plugin.WithBuildTargets(buildTargets()),
23+
plugin.WithKind(internalPlugin.Kind),
24+
plugin.WithTeam(internalPlugin.Team),
25+
plugin.WithJSONSchema(client.JSONSchema),
26+
plugin.WithConnectionTester(client.TestConnection),
27+
)
28+
if err := serve.Plugin(p, serve.WithDestinationV0V1Server()).Serve(context.Background()); err != nil {
29+
log.Fatal(err)
30+
}
31+
}
32+
33+
func buildTargets() []plugin.BuildTarget {
34+
// default build targets for FIPS builds
35+
// fipsEnabled is used to enable FIPS mode
36+
targets := make([]plugin.BuildTarget, len(plugin.DefaultBuildTargets))
37+
for i := range plugin.DefaultBuildTargets {
38+
targets[i] = plugin.DefaultBuildTargets[i]
39+
targets[i].Tags = append(targets[i].Tags, "fipsEnabled")
40+
}
41+
return targets
42+
}

‎plugins/destination/kafka/main.go‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,5 @@
1+
//go:build !fipsEnabled
2+
13
package main
24

35
import (

‎plugins/destination/kafka/main_fips.go‎

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
//go:build fipsEnabled
2+
3+
//go:debug fips140=on
4+
5+
package main
6+
7+
import (
8+
"context"
9+
"crypto/fips140"
10+
"log"
11+
12+
"github.com/cloudquery/cloudquery/plugins/destination/kafka/v5/client"
13+
"github.com/cloudquery/cloudquery/plugins/destination/kafka/v5/client/spec"
14+
internalPlugin "github.com/cloudquery/cloudquery/plugins/destination/kafka/v5/resources/plugin"
15+
"github.com/cloudquery/plugin-sdk/v4/plugin"
16+
"github.com/cloudquery/plugin-sdk/v4/serve"
17+
)
18+
19+
func main() {
20+
log.Printf("FIPS enabled: %t", fips140.Enabled())
21+
22+
p := plugin.NewPlugin(internalPlugin.Name, internalPlugin.Version, client.New,
23+
plugin.WithBuildTargets(buildTargets()),
24+
plugin.WithKind(internalPlugin.Kind),
25+
plugin.WithTeam(internalPlugin.Team),
26+
plugin.WithJSONSchema(spec.JSONSchema),
27+
)
28+
if err := serve.Plugin(p, serve.WithDestinationV0V1Server()).Serve(context.Background()); err != nil {
29+
log.Fatal(err)
30+
}
31+
}
32+
33+
func buildTargets() []plugin.BuildTarget {
34+
// default build targets for FIPS builds
35+
// fipsEnabled is used to enable FIPS mode
36+
targets := make([]plugin.BuildTarget, len(plugin.DefaultBuildTargets))
37+
for i := range plugin.DefaultBuildTargets {
38+
targets[i] = plugin.DefaultBuildTargets[i]
39+
targets[i].Tags = append(targets[i].Tags, "fipsEnabled")
40+
}
41+
return targets
42+
}

‎plugins/destination/postgresql/main.go‎

Lines changed: 9 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,5 @@
1+
//go:build !fipsEnabled
2+
13
package main
24

35
import (
@@ -6,17 +8,17 @@ import (
68

79
"github.com/cloudquery/cloudquery/plugins/destination/postgresql/v8/client"
810
"github.com/cloudquery/cloudquery/plugins/destination/postgresql/v8/client/spec"
9-
"github.com/cloudquery/cloudquery/plugins/destination/postgresql/v8/resources/plugin"
10-
pluginSDK "github.com/cloudquery/plugin-sdk/v4/plugin"
11+
internalPlugin "github.com/cloudquery/cloudquery/plugins/destination/postgresql/v8/resources/plugin"
12+
"github.com/cloudquery/plugin-sdk/v4/plugin"
1113
"github.com/cloudquery/plugin-sdk/v4/serve"
1214
)
1315

1416
func main() {
15-
p := pluginSDK.NewPlugin(plugin.Name, plugin.Version, client.New,
16-
pluginSDK.WithKind(plugin.Kind),
17-
pluginSDK.WithTeam(plugin.Team),
18-
pluginSDK.WithJSONSchema(spec.JSONSchema),
19-
pluginSDK.WithConnectionTester(client.ConnectionTester),
17+
p := plugin.NewPlugin(internalPlugin.Name, internalPlugin.Version, client.New,
18+
plugin.WithKind(internalPlugin.Kind),
19+
plugin.WithTeam(internalPlugin.Team),
20+
plugin.WithJSONSchema(spec.JSONSchema),
21+
plugin.WithConnectionTester(client.ConnectionTester),
2022
)
2123

2224
if err := serve.Plugin(p, serve.WithDestinationV0V1Server()).Serve(context.Background()); err != nil {

‎plugins/destination/postgresql/main_fips.go‎

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
//go:build fipsEnabled
2+
3+
//go:debug fips140=on
4+
5+
package main
6+
7+
import (
8+
"context"
9+
"crypto/fips140"
10+
"log"
11+
12+
"github.com/cloudquery/cloudquery/plugins/destination/postgresql/v8/client"
13+
"github.com/cloudquery/cloudquery/plugins/destination/postgresql/v8/client/spec"
14+
internalPlugin "github.com/cloudquery/cloudquery/plugins/destination/postgresql/v8/resources/plugin"
15+
"github.com/cloudquery/plugin-sdk/v4/plugin"
16+
"github.com/cloudquery/plugin-sdk/v4/serve"
17+
)
18+
19+
func main() {
20+
log.Printf("FIPS enabled: %t", fips140.Enabled())
21+
22+
p := plugin.NewPlugin(internalPlugin.Name, internalPlugin.Version, client.New,
23+
plugin.WithBuildTargets(buildTargets()),
24+
plugin.WithKind(internalPlugin.Kind),
25+
plugin.WithTeam(internalPlugin.Team),
26+
plugin.WithJSONSchema(spec.JSONSchema),
27+
plugin.WithConnectionTester(client.ConnectionTester),
28+
)
29+
if err := serve.Plugin(p, serve.WithDestinationV0V1Server()).Serve(context.Background()); err != nil {
30+
log.Fatal(err)
31+
}
32+
}
33+
34+
func buildTargets() []plugin.BuildTarget {
35+
// default build targets for FIPS builds
36+
// fipsEnabled is used to enable FIPS mode
37+
targets := make([]plugin.BuildTarget, len(plugin.DefaultBuildTargets))
38+
for i := range plugin.DefaultBuildTargets {
39+
targets[i] = plugin.DefaultBuildTargets[i]
40+
targets[i].Tags = append(targets[i].Tags, "fipsEnabled")
41+
}
42+
return targets
43+
}

0 commit comments

Comments
 (0)