Skip to content

Commit

Permalink
Remove custom BoringSSL build
Browse files Browse the repository at this point in the history 
The `boring` crate will compile BoringSSL on demand.

Additionally, add a few missing git commit hash validations that were noticed.
  • Loading branch information
@reedloden
reedloden committed Oct 28, 2023
1 parent 8370b3a commit 9493097
Show file tree
Hide file tree
Showing 12 changed files with 214 additions and 181 deletions.
8 changes: 5 additions & 3 deletions build.assets/Dockerfile
View file
Original file line number Diff line number Diff line change
Expand Up @@ -251,9 +251,11 @@ RUN make -C /opt/pam_teleport install
ENV SOFTHSM2_PATH "/usr/lib/softhsm/libsofthsm2.so"

# Install bats.
RUN curl -fsSL https://github.com/bats-core/bats-core/archive/v1.2.1.tar.gz | tar -xz && \
cd bats-core-1.2.1 && ./install.sh /usr/local && cd .. && \
rm -r bats-core-1.2.1
RUN git clone --depth=1 https://github.com/bats-core/bats-core.git -b v1.2.1 && \

Check warning on line 254 in build.assets/Dockerfile

View check run for this annotation

Orca Security (US) / Orca Security - Infrastructure as Code

[MEDIUM] RUN Instruction Using 'cd' Instead of WORKDIR 

Details:
When using RUN command 'cd' should only be used for full path. For relative path
make use of WORKDIR command instead.

Recommendation:
Using WORKDIR to change directory
cd bats-core && \
[ "$(git rev-parse HEAD)" = 'dcaec03e32e0b152f8ef9cf14b75296cf5caeaff' ] && \
./install.sh /usr/local && cd .. && \
rm -r bats-core

# Install shellcheck.
RUN scversion='v0.9.0' && \
Expand Down
110 changes: 97 additions & 13 deletions build.assets/Dockerfile-centos7
View file
Original file line number Diff line number Diff line change
@@ -1,12 +1,28 @@
# syntax=docker/dockerfile:1

ARG RUST_VERSION

## GIT2 ###################################################################

# git2 packages are not available on ARM64, so we need to build it from source.
FROM centos:7 AS git2

ARG BUILDARCH
ARG TARGETARCH
ARG DEVTOOLSET

# devtoolset-12 is only in CentOS buildlogs. The rpms are unsigned since they never were
# published to the official CentOS SCL repos.
RUN if [ "${TARGETARCH}" = "arm64" ]; then export TARGETARCH="aarch64"; fi && \
cat <<EOF > /etc/yum.repos.d/${DEVTOOLSET}-build.repo
[${DEVTOOLSET}-build]
name=${DEVTOOLSET} - Build
baseurl=https://buildlogs.centos.org/c7-${DEVTOOLSET}.${TARGETARCH}/
gpgcheck=0
enabled=1
EOF

# Install required dependencies.
RUN yum groupinstall -y 'Development Tools' && \

Check warning on line 26 in build.assets/Dockerfile-centos7

View check run for this annotation

Orca Security (US) / Orca Security - Infrastructure as Code

[LOW] Yum install Without Version 

Details:
Not specifying the package version can cause failures due to unanticipated
changes in required packages

Recommendation:
The package version should always be specified when using yum install
yum install -y \
ca-certificates \
Expand All @@ -20,43 +36,63 @@ RUN yum groupinstall -y 'Development Tools' && \
yum update -y && \
yum -y install centos-release-scl-rh && \
yum install -y \
centos-release-scl \
${DEVTOOLSET}-gcc* \
${DEVTOOLSET}-make && \
centos-release-scl && \
yum clean all

# As mentioned above, these packages are unsigned.
RUN yum install --nogpgcheck -y \
${DEVTOOLSET}-gcc* \
${DEVTOOLSET}-make && \
yum clean all

RUN wget https://github.com/git/git/archive/refs/tags/v2.42.0.tar.gz && \
tar xf v2.42.0.tar.gz && \
cd git-2.42.0/ && \
RUN git clone --depth=1 https://github.com/git/git.git -b v2.42.0 && \

Check warning on line 48 in build.assets/Dockerfile-centos7

View check run for this annotation

Orca Security (US) / Orca Security - Infrastructure as Code

[MEDIUM] RUN Instruction Using 'cd' Instead of WORKDIR 

Details:
When using RUN command 'cd' should only be used for full path. For relative path
make use of WORKDIR command instead.

Recommendation:
Using WORKDIR to change directory
cd git && \
[ "$(git rev-parse HEAD)" = '43c8a30d150ecede9709c1f2527c8fba92c65f40' ] && \
scl enable ${DEVTOOLSET} "make configure && \
./configure --prefix=/usr/local && \
make -j"$(nproc)" all && \
DESTDIR=/opt/git make install"

# Create an alias to the assets image. Ref: https://github.com/docker/for-mac/issues/2155
ARG BUILDARCH
FROM ghcr.io/gravitational/teleport-buildbox-centos7-assets:teleport14-${BUILDARCH} AS teleport-buildbox-centos7-assets
FROM ghcr.io/gravitational/teleport-buildbox-centos7-assets:teleport15-${BUILDARCH} AS teleport-buildbox-centos7-assets

## LIBFIDO2 ###################################################################

# Build libfido2 separately for isolation, speed and flexibility.
FROM centos:7 AS libfido2

Check warning on line 63 in build.assets/Dockerfile-centos7

View check run for this annotation

Orca Security (US) / Orca Security - Infrastructure as Code

[MEDIUM] RUN Instruction Using 'cd' Instead of WORKDIR 

Details:
When using RUN command 'cd' should only be used for full path. For relative path
make use of WORKDIR command instead.

Recommendation:
Using WORKDIR to change directory

ARG DEVTOOLSET
ARG TARGETARCH

# devtoolset-12 is only in CentOS buildlogs. The rpms are unsigned since they never were
# published to the official CentOS SCL repos.
RUN if [ "${TARGETARCH}" = "arm64" ]; then export TARGETARCH="aarch64"; fi && \
cat <<EOF > /etc/yum.repos.d/${DEVTOOLSET}-build.repo
[${DEVTOOLSET}-build]
name=${DEVTOOLSET} - Build
baseurl=https://buildlogs.centos.org/c7-${DEVTOOLSET}.${TARGETARCH}/
gpgcheck=0
enabled=1
EOF

RUN yum groupinstall -y 'Development Tools' && \

Check warning on line 79 in build.assets/Dockerfile-centos7

View check run for this annotation

Orca Security (US) / Orca Security - Infrastructure as Code

[LOW] Yum install Without Version 

Details:
Not specifying the package version can cause failures due to unanticipated
changes in required packages

Recommendation:
The package version should always be specified when using yum install
yum install -y epel-release && \
yum install -y centos-release-scl-rh && \
yum update -y && \
yum install -y \
cmake3 \
${DEVTOOLSET}-gcc* \
git \
libudev-devel \
perl-IPC-Cmd \
zlib-devel && \
yum clean all

# As mentioned above, these packages are unsigned.
RUN yum install --nogpgcheck -y \
${DEVTOOLSET}-gcc* && \
yum clean all

# Install libudev-zero.
# libudev-zero replaces systemd's libudev.
RUN git clone --depth=1 https://github.com/illiliti/libudev-zero.git -b 1.0.3 && \

Check warning on line 98 in build.assets/Dockerfile-centos7

View check run for this annotation

Orca Security (US) / Orca Security - Infrastructure as Code

[MEDIUM] RUN Instruction Using 'cd' Instead of WORKDIR 

Details:
When using RUN command 'cd' should only be used for full path. For relative path
make use of WORKDIR command instead.

Recommendation:
Using WORKDIR to change directory
Expand Down Expand Up @@ -108,6 +144,18 @@ RUN git clone --depth=1 https://github.com/Yubico/libfido2.git -b 1.13.0 && \
FROM centos:7 AS libbpf

ARG DEVTOOLSET
ARG TARGETARCH

# devtoolset-12 is only in CentOS buildlogs. The rpms are unsigned since they never were
# published to the official CentOS SCL repos.
RUN if [ "${TARGETARCH}" = "arm64" ]; then export TARGETARCH="aarch64"; fi && \
cat <<EOF > /etc/yum.repos.d/${DEVTOOLSET}-build.repo
[${DEVTOOLSET}-build]
name=${DEVTOOLSET} - Build
baseurl=https://buildlogs.centos.org/c7-${DEVTOOLSET}.${TARGETARCH}/
gpgcheck=0
enabled=1
EOF

# Install required dependencies.
RUN yum groupinstall -y 'Development Tools' && \

Check warning on line 161 in build.assets/Dockerfile-centos7

View check run for this annotation

Orca Security (US) / Orca Security - Infrastructure as Code

[LOW] Yum install Without Version 

Details:
Not specifying the package version can cause failures due to unanticipated
changes in required packages

Recommendation:
The package version should always be specified when using yum install
Expand All @@ -116,12 +164,16 @@ RUN yum groupinstall -y 'Development Tools' && \
yum -y install centos-release-scl-rh && \
yum install -y \
centos-release-scl \
${DEVTOOLSET}-gcc* \
${DEVTOOLSET}-make \
elfutils-libelf-devel-static \
scl-utils && \
yum clean all

# As mentioned above, these packages are unsigned.
RUN yum install --nogpgcheck -y \
${DEVTOOLSET}-gcc* \
${DEVTOOLSET}-make && \
yum clean all

# Install libbpf - compile with a newer GCC. The one installed by default is not able to compile it.
# BUILD_STATIC_ONLY disables libbpf.so build as we don't need it.
ARG LIBBPF_VERSION
Expand All @@ -135,6 +187,18 @@ RUN mkdir -p /opt && cd /opt && \
FROM centos:7 AS libpcsclite

ARG DEVTOOLSET
ARG TARGETARCH

# devtoolset-12 is only in CentOS buildlogs. The rpms are unsigned since they never were
# published to the official CentOS SCL repos.
RUN if [ "${TARGETARCH}" = "arm64" ]; then export TARGETARCH="aarch64"; fi && \
cat <<EOF > /etc/yum.repos.d/${DEVTOOLSET}-build.repo
[${DEVTOOLSET}-build]
name=${DEVTOOLSET} - Build
baseurl=https://buildlogs.centos.org/c7-${DEVTOOLSET}.${TARGETARCH}/
gpgcheck=0
enabled=1
EOF

# Install required dependencies.
RUN yum groupinstall -y 'Development Tools' && \

Check warning on line 204 in build.assets/Dockerfile-centos7

View check run for this annotation

Orca Security (US) / Orca Security - Infrastructure as Code

[LOW] Yum install Without Version 

Details:
Not specifying the package version can cause failures due to unanticipated
changes in required packages

Recommendation:
The package version should always be specified when using yum install
Expand All @@ -145,6 +209,10 @@ RUN yum groupinstall -y 'Development Tools' && \
libudev-devel \
scl-utils \
centos-release-scl \
yum clean all

# As mentioned above, these packages are unsigned.
RUN yum install --nogpgcheck -y \
${DEVTOOLSET}-gcc* && \
yum clean all

Expand All @@ -169,21 +237,31 @@ ENV LANGUAGE=en_US.UTF-8 \
ARG GOLANG_VERSION
ARG RUST_VERSION
ARG DEVTOOLSET
ARG TARGETARCH

ARG UID
ARG GID
RUN (groupadd ci --gid=$GID -o && useradd ci --uid=$UID --gid=$GID --create-home --shell=/bin/sh && \
mkdir -p -m0700 /var/lib/teleport && chown -R ci /var/lib/teleport)

# devtoolset-12 is only in CentOS buildlogs. The rpms are unsigned since they never were
# published to the official CentOS SCL repos.
RUN if [ "${TARGETARCH}" = "arm64" ]; then export TARGETARCH="aarch64"; fi && \
cat <<EOF > /etc/yum.repos.d/${DEVTOOLSET}-build.repo
[${DEVTOOLSET}-build]
name=${DEVTOOLSET} - Build
baseurl=https://buildlogs.centos.org/c7-${DEVTOOLSET}.${TARGETARCH}/
gpgcheck=0
enabled=1
EOF

RUN yum groupinstall -y 'Development Tools' && \
yum install -y epel-release && \
yum update -y && \
yum -y install centos-release-scl-rh && \
yum install -y \
#required by libbpf
centos-release-scl \
# required by libbpf
${DEVTOOLSET}-* \
centos-release-scl \
# required by libbpf
elfutils-libelf-devel-static \
net-tools \
Expand All @@ -199,6 +277,12 @@ RUN yum groupinstall -y 'Development Tools' && \
yum clean all && \
localedef -c -i en_US -f UTF-8 en_US.UTF-8

# As mentioned above, these packages are unsigned.
RUN yum install --nogpgcheck -y \
${DEVTOOLSET}-gcc* \
${DEVTOOLSET}-make && \
yum clean all

# Override the old git in /usr/local installed by yum. We need git 2+ on GitHub Actions.
COPY --from=git2 /opt/git /

Expand Down
36 changes: 27 additions & 9 deletions build.assets/Dockerfile-centos7-assets
View file
Original file line number Diff line number Diff line change
@@ -1,6 +1,18 @@
FROM centos:7 AS centos-devtoolset

Check warning on line 1 in build.assets/Dockerfile-centos7-assets

View check run for this annotation

Orca Security (US) / Orca Security - Infrastructure as Code

[LOW] Yum install Without Version 

Details:
Not specifying the package version can cause failures due to unanticipated
changes in required packages

Recommendation:
The package version should always be specified when using yum install

ARG DEVTOOLSET
ARG TARGETARCH

# devtoolset-12 is only in CentOS buildlogs. The rpms are unsigned since they never were
# published to the official CentOS SCL repos.
RUN if [ "${TARGETARCH}" = "arm64" ]; then export TARGETARCH="aarch64"; fi && \
cat <<EOF > /etc/yum.repos.d/${DEVTOOLSET}-build.repo
[${DEVTOOLSET}-build]
name=${DEVTOOLSET} - Build
baseurl=https://buildlogs.centos.org/c7-${DEVTOOLSET}.${TARGETARCH}/
gpgcheck=0
enabled=1
EOF

# Install required dependencies.
RUN yum groupinstall -y 'Development Tools' && \
Expand All @@ -12,10 +24,6 @@ RUN yum groupinstall -y 'Development Tools' && \
centos-release-scl \
# required by Clang/LLVM
cmake3 \
# required by libbpf and Clang
${DEVTOOLSET}-gcc* \
# required by libbpf
${DEVTOOLSET}-make \
# required by libbpf
elfutils-libelf-devel \
# required by libbpf
Expand All @@ -29,19 +37,29 @@ RUN yum groupinstall -y 'Development Tools' && \
zlib-static && \
yum clean all

# As mentioned above, these packages are unsigned.
RUN yum install --nogpgcheck -y \
${DEVTOOLSET}-gcc* \
${DEVTOOLSET}-make && \
yum clean all

# Use just created devtool image with newer GCC and Cmake
FROM centos-devtoolset as clang10
FROM centos-devtoolset as clang12

Check warning on line 47 in build.assets/Dockerfile-centos7-assets

View check run for this annotation

Orca Security (US) / Orca Security - Infrastructure as Code

[MEDIUM] RUN Instruction Using 'cd' Instead of WORKDIR 

Details:
When using RUN command 'cd' should only be used for full path. For relative path
make use of WORKDIR command instead.

Recommendation:
Using WORKDIR to change directory

ARG DEVTOOLSET

# Compile Clang 10.0.1 from source. It is needed to create BPF files.
# Centos 7 doesn't provide it as a package unfortunately.
# Compile Clang 12.0.0 from source. It is needed to create BoringSSL and BPF files.
# CentOS 7 doesn't provide it as a package unfortunately.
# This version of Clang is explicitly required for FIPS compliance when building BoringSSL.
# For more information please refer to the section 12. Guidance and Secure Operation of:
# https://csrc.nist.gov/CSRC/media/projects/cryptographic-module-validation-program/documents/security-policies/140sp4407.pdf
# LLVM_INCLUDE_BENCHMARKS must be off, otherwise compilation fails,
# CLANG_BUILD_TOOLS must be on, it builds clang binary,
# LLVM_BUILD_TOOLS must be on, it builds llvm-strip binary.
# the rest is disabled to speedup the compilation.
RUN git clone --branch llvmorg-10.0.1 --depth=1 https://github.com/llvm/llvm-project.git && \
RUN git clone --branch llvmorg-12.0.0 --depth=1 https://github.com/llvm/llvm-project.git && \
cd llvm-project/ && \
[ "$(git rev-parse HEAD)" = 'd28af7c654d8db0b68c175db5ce212d74fb5e9bc' ] && \
mkdir build && cd build/ && \
scl enable ${DEVTOOLSET} 'bash -c "cmake3 \
-DCLANG_BUILD_TOOLS=ON \
Expand All @@ -68,4 +86,4 @@ RUN git clone --branch llvmorg-10.0.1 --depth=1 https://github.com/llvm/llvm-pro
FROM scratch AS buildbox-centos7-assets

Check warning on line 86 in build.assets/Dockerfile-centos7-assets

View check run for this annotation

Orca Security (US) / Orca Security - Infrastructure as Code

[LOW] Healthcheck Instruction Missing 

Details:
Ensure that HEALTHCHECK is being used. The HEALTHCHECK instruction tells Docker
how to test a container to check that it is still working

Recommendation:
Dockerfile should contain instruction 'HEALTHCHECK'

Check warning on line 86 in build.assets/Dockerfile-centos7-assets

View check run for this annotation

Orca Security (US) / Orca Security - Infrastructure as Code

[MEDIUM] Missing User Instruction 

Details:
A user should be specified in the dockerfile, otherwise the image will run as
root

Recommendation:
The 'Dockerfile' should contain the 'USER' instruction

# Copy Clang into the final image.
COPY --from=clang10 /opt/llvm /opt/llvm/
COPY --from=clang12 /opt/llvm /opt/llvm/
Loading

0 comments on commit 9493097

Please sign in to comment.