Merge branch 'fips-cleanup' into 'master'

Simplify building in FIPS mode

See merge request gitlab-org/gitlab-pages!734

4 files changed, 22 insertions, 9 deletions

diff --git a/Makefile.build.mk b/Makefile.build.mk
index 9e681d8e..915b1d02 100644
--- a/Makefile.build.mk
+++ b/Makefile.build.mk
@@ -1,5 +1,10 @@
 BINDIR := $(CURDIR)/bin
 GO_BUILD_TAGS   := continuous_profiler_stackdriver
+FIPS_MODE       ?= 0
+ifeq ($(FIPS_MODE), 1)
+    GO_BUILD_TAGS := $(GO_BUILD_TAGS),boringcrypto
+    CGO_ENABLED := 1
+endif
 
 # To compute a unique and deterministic value for GNU build-id, we build the Go binary a second time.
 # From the first build, we extract its unique and deterministic Go build-id, and use that to derive
@@ -34,16 +39,12 @@ ifndef WITHOUT_BUILD_ID
 	GNU_BUILD_ID=$$( echo $$GO_BUILD_ID | sha1sum | cut -d' ' -f1 ) && \
 	$Q GOBIN=$(BINDIR) go install $(if $V,-v) -ldflags="$(VERSION_FLAGS) -B 0x$$GNU_BUILD_ID" -tags "${GO_BUILD_TAGS}" -buildmode exe $(IMPORT_PATH)
 endif
+ifeq ($(FIPS_MODE), 1)
+	go tool nm $(BINDIR)/gitlab-pages | grep boringcrypto >/dev/null &&  echo "binary is correctly built in FIPS mode" || (echo "binary is not correctly built in FIPS mode" && exit 1)
+endif
 
 clean:
 	$Q GOBIN=$(BINDIR) go clean -i -modcache -x
 
 gitlab-pages: build
 	$Q cp -f $(BINDIR)/gitlab-pages .
-
-validate-fips-build:
-	go tool nm ./gitlab-pages | grep boringcrypto >/dev/null &&  echo "binary is correctly built in FIPS mode" || (echo "binary is not correctly built in FIPS mode" && exit 1)
-
-gitlab-pages-fips: GO_BUILD_TAGS := $(GO_BUILD_TAGS),boringcrypto
-gitlab-pages-fips: CGO_ENABLED := 1
-gitlab-pages-fips: gitlab-pages validate-fips-build
diff --git a/doc/development.md b/doc/development.md
index 2b8001a4..77603683 100644
--- a/doc/development.md
+++ b/doc/development.md
@@ -21,6 +21,11 @@ Build and start the app. For any changes, you must run `make` to build the app,
 make && ./gitlab-pages -config=gitlab-pages.conf
 ```
 
+To build in FIPS mode
+```
+$ FIPS_MODE=1 make && ./gitlab-pages -config=gitlab-pages.conf
+```
+
 Visit http://group.192.168.1.135.nip.io:8090/project/index.html (replace `192.168.1.135` with your IP) and you should see a
 `project-subdir` response
 
diff --git a/internal/boring/boring.go b/internal/boring/boring.go
index 0a59ec4a..e6d19aeb 100644
--- a/internal/boring/boring.go
+++ b/internal/boring/boring.go
@@ -9,10 +9,15 @@ import (
 	"gitlab.com/gitlab-org/labkit/log"
 )
 
+// CheckBoring checks whether FIPS crypto has been enabled. For the FIPS Go
+// compiler in https://github.com/golang-fips/go, this requires that:
+//
+// 1. The kernel has FIPS enabled (e.g. `/proc/sys/crypto/fips_enabled` is 1).
+// 2. A system OpenSSL can be dynamically loaded via ldopen().
 func CheckBoring() {
 	if boring.Enabled() {
-		log.Info("FIPS mode is enabled. Using BoringSSL.")
+		log.Info("FIPS mode is enabled. Using an external SSL library.")
 		return
 	}
-	log.Info("GitLab Pages was compiled with FIPS mode but BoringSSL is not enabled.")
+	log.Info("GitLab Pages was compiled with FIPS mode but an external SSL library was not enabled.")
 }
diff --git a/internal/boring/notboring.go b/internal/boring/notboring.go
index 6dbf3c39..1a7eb52f 100644
--- a/internal/boring/notboring.go
+++ b/internal/boring/notboring.go
@@ -3,5 +3,7 @@
 
 package boring
 
+// CheckBoring does nothing when the boringcrypto tag is not in the
+// build.
 func CheckBoring() {
 }