Add FIPS support to build process and update .gitignore #2049

stafot · 2025-07-18T11:31:53Z

Summary

Introduced FIPS compliance build options in the Makefile, allowing for the creation of FIPS-compliant plugins using Docker.
Added new targets for building and bundling FIPS plugins.
Updated the manifest generation to support outputting to a FIPS-specific directory.
Modified .gitignore to include FIPS-related directories and build cache.

Ticket Link

https://mattermost.atlassian.net/browse/CLD-9414

Checklist

Telemetry updated
Gated by experimental feature flag
Unit tests updated

hmhealey

I've got a few questions, mostly for my own understanding since I know very little about FIPS compliance

hmhealey · 2025-07-22T21:21:38Z

.github/workflows/ci.yaml


-      - name: ci/ensure-build-on-all-platforms
-        run: make dist
+      - name: ci/setup-node


Why do we need to set up the web app's dependencies now when we didn't have to before? I'm actually kind of surprised that that wasn't part of this pipeline before

It's already there - L34-41 :)

I see that up there, but that's in the lint job instead of the dist one. Since this one sets up its own workspace, it looks like we've previously just linted the web app and that we haven't been compiling it.

From what I can tell, this container must already come with Node by default, so we haven't needed to set up a specific version of Node before, and we haven't had to install the NPM dependencies manually because the Makefile is set up to do that if they're missing

Makefile

hmhealey · 2025-07-22T21:39:01Z

Makefile

+	# Build directly in the FIPS container without external script
+	# Create local cache directory for CI/ACT compatibility


For my own understanding, the FIPS build requires us to build the server code in the provided Docker image without running any external scripts, is that right?

.github/actions/e2e-test/action.yaml

hmhealey · 2025-07-22T21:42:28Z

Makefile

Should any of these changes make it back into the starter template so that any new plugins we make will have FIPS available? I get that we probably don't want this turned on for community plugins and such, but it seems like it would help share it among our plugin builds

feel free to inherit them there!

.github/actions/e2e-test/action.yaml

agnivade · 2025-07-23T03:55:46Z

.github/workflows/ci.yaml


-      - name: ci/ensure-build-on-all-platforms
-        run: make dist
+      - name: ci/setup-node


It's already there - L34-41 :)

.github/workflows/ci.yaml

Makefile

agnivade · 2025-07-23T04:07:30Z

Makefile

+	GO_FIPS ?= docker run --rm -v $(PWD):/plugin -v $(HOME)/.cache:/root/.cache -w /plugin -e GOFLAGS -e GO111MODULE $(FIPS_IMAGE) go
+	GO_BUILD_TAGS_FIPS = fips


Where are these GO_FIPS and GO_BUILD_TAGS_FIPS variables used?

agnivade · 2025-07-23T04:07:57Z

Makefile

+		$(FIPS_IMAGE) \
+		/bin/sh -c "\
+			echo 'Go already available: ' && go version && \
+			export GO111MODULE=on && \


We can remove this line. It's not needed anymore.

Makefile

build/manifest/main.go

.github/workflows/ci.yaml

Makefile

agnivade

Just a minor comment

Makefile

esarafianou

Thanks Stavro!

- Introduced FIPS compliance build options in the Makefile, allowing for the creation of FIPS-compliant plugins using Docker. - Added new targets for building and bundling FIPS plugins. - Updated the manifest generation to support outputting to a FIPS-specific directory. - Modified .gitignore to include FIPS-related directories and build cache.

- Introduced a new `dist-fips` job in the CI workflow to support building FIPS-compliant plugins. - Added steps for checking out the repository, setting up Go and Node.js environments, caching Node modules, and logging into the Chainguard registry. - Implemented artifact upload for FIPS build outputs, enhancing the CI process for FIPS compliance.

- Modified the FIPS plugin build command to include the `-buildvcs=false` flag, ensuring that version control information is not included in the build output.

- Updated the Go setup in multiple GitHub Actions to enable caching, improving build performance by reusing dependencies across runs.

…S builds in parallel, improving efficiency.

Signed-off-by: Stavros Foteinopoulos <[email protected]>

- Changed the FIPS image to a new version for improved compatibility. - Modified the build command to enable CGO and streamline the Go installation process, ensuring a more efficient build for FIPS-compliant plugins.

Signed-off-by: Stavros Foteinopoulos <[email protected]>

agarciamontoro · 2025-09-12T08:41:56Z

No need to rebase this branch on top of anything else, this is already branched off the v2.4.1 tag, the latest version to be prepackaged.

* Translated using Weblate (German) Currently translated at 100.0% (46 of 46 strings) Translation: Playbooks/server Translate-URL: https://translate.mattermost.com/projects/playbooks/server/de/ * Translated using Weblate (Polish) Currently translated at 100.0% (46 of 46 strings) Translation: Playbooks/server Translate-URL: https://translate.mattermost.com/projects/playbooks/server/pl/ --------- Co-authored-by: jprusch <[email protected]> Co-authored-by: master7 <[email protected]>

* Translated using Weblate (Dutch) Currently translated at 100.0% (46 of 46 strings) Translation: Playbooks/server Translate-URL: https://translate.mattermost.com/projects/playbooks/server/nl/ * Translated using Weblate (Swedish) Currently translated at 100.0% (46 of 46 strings) Translation: Playbooks/server Translate-URL: https://translate.mattermost.com/projects/playbooks/server/sv/ --------- Co-authored-by: Tom De Moor <[email protected]> Co-authored-by: MArtin Johnson <[email protected]>

Co-authored-by: unified-ci-app[bot] <121569378+unified-ci-app[bot]@users.noreply.github.com>

agarciamontoro · 2025-09-18T17:22:31Z

I just cherry-picked all commits in the v2.4.1...v2.4.2 diff except for a commit that modified the CI pipeline and had conflicts with the changes in this PR.

stafot · 2025-09-19T10:38:47Z

the reason for not running are the conflicts that need to be resolved @agarciamontoro

agarciamontoro · 2025-09-19T10:53:25Z

I was able to merge master, including the previously ignored commit. Let's see if this works.

agarciamontoro · 2025-09-19T11:42:59Z

It worked! Thank you, @stafot <3

mattermost-build · 2025-10-17T01:07:27Z

This PR has been automatically labelled "stale" because it hasn't had recent activity.
A core team member will check in on the status of the PR to help with questions.
Thank you for your contribution!

Bumping mattermost-plugin-playbooks to version 2.5.0 # -----BEGIN PGP SIGNATURE----- # # iQIzBAABCAAdFiEEXpuxF1ERdvMJE+HprmJVCBCXQzQFAmjtaCMACgkQrmJVCBCX # QzSaxxAAvOeeqmYxMETaxOP3EG9kB3+EpYGGVMQZd5NTHtx8bHp1GKjREIgEx/Sp # XEyDDpftrtpvPVogoyuBjbQMhA32Nlo7CLN3884cWpJvgGRiKuqKxAmn5RtOgCV8 # DjjuLOm5llK7TaA1Mi4UC255OTRB/SGsYwmL2pStX9j2NTt8CQEVbz9kVwT5TQJx # olEbHj2GzWceUPtPuB6VMuJTXC/lX8rtDiDeTPhfrxgeyfWAybs2vjgWPdevSHva # KhnramUlRufuI7EuQGmrc7LTti+hOXIVuTfMv7kIKU+mWWIG8cb2flz3hGeZaBP3 # toXbYgItXrZC07NyxEaIcfk4Azo1O/S/4kHe60H7Jj/OiKvX8ufAUHNVttA1Poug # 3w2kQm3cIxYb8uMQB+nNVkWSfIllXwn7gS5JD9ImF3wCHMHkPlCByGjH3UbUNt2Q # WobjpTGbwFZ3H/C3B8jRTWRI00Ctp3bjMkVUdD4TfO312eVpkNrkDutwtws3EdwD # 0VWNY/s0yUB0tApRcmnCba73qjI85MwhHJCjtRMUegDYHYGE10vEhKMcg768T7Y2 # +5UtcU9a/bHjRIq8ihYDB3NZt20TwhCcbj+VhacPPmhStSPmu/4WghivoMJOm1ge # IuHeG3s++GUcW+CoZX6SLFMGqr4mJ1qajhqfnY0T7WS+5+WN9e8= # =fK6n # -----END PGP SIGNATURE----- # gpg: Signature made lun 13 oct 2025 22:59:15 CEST # gpg: using RSA key 5E9BB117511176F30913E1E9AE62550810974334 # gpg: Can't check signature: No public key

dryrunsecurity · 2025-10-28T12:39:30Z

This pull request grants a job id-token: write and runs make dist-all, which could allow an attacker who can inject code via a pull request to execute arbitrary commands and exfiltrate the OIDC token (especially since the workflow uses a secret-based identity input). It also pipes CHAINGUARD_DEV_TOKEN to docker login via stdin in the Makefile, which increases the risk of accidental credential leakage in build logs compared with using a purpose-built, secret-safe action.

Potential OIDC Token Theft in .github/workflows/ci.yaml

Vulnerability	Potential OIDC Token Theft
Description	The `dist` job (referred to as `build` in the plan) is granted `id-token: write` permission, which is necessary for OIDC authentication with Chainguard. While the `setup-chainctl` action itself is a trusted third-party action, the `identity` input is sourced from `secrets.CHAINGUARD_IDENTITY`. If this secret were compromised, or if a prior step in the workflow (e.g., `make dist-all` which executes a Makefile) could be manipulated by an attacker via a pull request to inject malicious commands, the OIDC token could be exfiltrated. The `display-signing-parameters` step also processes `github.sha` and `github.event.number` which are attacker-controlled in a pull request, but the output is only to the workflow log, not directly used in a way that would compromise the OIDC token. The primary risk lies in the execution of `make dist-all` which could be influenced by malicious code in a pull request, potentially leading to arbitrary code execution within the job and subsequent OIDC token theft.

mattermost-plugin-playbooks/.github/workflows/ci.yaml

Lines 102 to 105 in c140653

    
             id-token: write  # Required for OIDC authentication with Chainguard identity 
        
           steps: 
        
             - name: ci/checkout-repo 
        
               uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

Potential for Information Disclosure of Credentials in Build Logs in Makefile

Vulnerability	Potential for Information Disclosure of Credentials in Build Logs
Description	The Makefile directly pipes the `CHAINGUARD_DEV_TOKEN` secret to `docker login` via standard input. While GitHub Actions attempts to mask secrets in logs, relying on this mechanism for secrets passed via `stdin` in shell commands is not explicitly documented as a secure practice and carries a higher risk of accidental exposure compared to using dedicated actions designed for secure credential handling. If the masking fails or the command output is inadvertently captured, the token could be exposed in build logs.

mattermost-plugin-playbooks/Makefile

Lines 266 to 269 in c140653

    
           	echo "$(CHAINGUARD_DEV_TOKEN)" | docker login cgr.dev --username "$(CHAINGUARD_DEV_USERNAME)" --password-stdin; \ 
        
           else \ 
        
           	echo "Warning: No authentication available. FIPS build may fail."; \ 
        
           fi; \

All finding details can be found in the DryRun Security Dashboard.

agarciamontoro · 2025-10-28T16:47:57Z

Merged up to the v2.5.0 tag for prepackaging for MM v11.1

stafot requested review from Willyfrog, agnivade, esarafianou and hmhealey July 22, 2025 10:07

hmhealey reviewed Jul 22, 2025

View reviewed changes

agnivade suggested changes Jul 23, 2025

View reviewed changes

esarafianou requested changes Jul 31, 2025

View reviewed changes

.github/workflows/ci.yaml Outdated Show resolved Hide resolved

Makefile Outdated Show resolved Hide resolved

Willyfrog removed their request for review August 5, 2025 10:52

stafot requested review from agnivade and esarafianou August 6, 2025 07:05

agnivade approved these changes Aug 7, 2025

View reviewed changes

Makefile Outdated Show resolved Hide resolved

hmhealey approved these changes Aug 12, 2025

View reviewed changes

esarafianou approved these changes Aug 20, 2025

View reviewed changes

stafot force-pushed the CLD-9414-build-playbooks-fips-compliant branch from ff012de to 6227f4e Compare August 21, 2025 10:13

stafot force-pushed the CLD-9414-build-playbooks-fips-compliant branch from ae56996 to 4d2173d Compare September 3, 2025 13:00

angeloskyratzakos and others added 15 commits September 8, 2025 14:33

Update FIPS build command in Makefile to disable VCS information

bfc594e

- Modified the FIPS plugin build command to include the `-buildvcs=false` flag, ensuring that version control information is not included in the build output.

Enable caching for Go setup in CI workflows and actions

97fe92c

- Updated the Go setup in multiple GitHub Actions to enable caching, improving build performance by reusing dependencies across runs.

Enhance Makefile and CI workflow for building distributions

2d0385d

Optimize distribution build process in Makefile to run normal and FIP…

eadc8dc

…S builds in parallel, improving efficiency.

use fips image with no vulns

5cdcf60

Signed-off-by: Stavros Foteinopoulos <[email protected]>

Update FIPS image in Makefile and adjust build command for Go setup

b491d8a

- Changed the FIPS image to a new version for improved compatibility. - Modified the build command to enable CGO and streamline the Go installation process, ensuring a more efficient build for FIPS-compliant plugins.

review fixes

4c81bf0

Signed-off-by: Stavros Foteinopoulos <[email protected]>

fix makefile to use chainctl identity

aad8368

Signed-off-by: Stavros Foteinopoulos <[email protected]>

chainctl action test 2

7fcffaa

Signed-off-by: Stavros Foteinopoulos <[email protected]>

chainctl action test 3

12e8e3a

Signed-off-by: Stavros Foteinopoulos <[email protected]>

fix tar naming issue

3dd31e7

Signed-off-by: Stavros Foteinopoulos <[email protected]>

fixes

4f90dc6

Signed-off-by: Stavros Foteinopoulos <[email protected]>

fixes 2

f8d1a44

Signed-off-by: Stavros Foteinopoulos <[email protected]>

stafot added 3 commits September 8, 2025 14:55

Remove sign from CI

ab76a60

Signed-off-by: Stavros Foteinopoulos <[email protected]>

Add manual artifacts CI sign for plugins - fixes

1093b51

Signed-off-by: Stavros Foteinopoulos <[email protected]>

rebase fixes

29cc4d0

Signed-off-by: Stavros Foteinopoulos <[email protected]>

stafot force-pushed the CLD-9414-build-playbooks-fips-compliant branch from 49c0411 to 29cc4d0 Compare September 8, 2025 12:01

stafot added 3 commits September 11, 2025 15:06

add version prefix

a803a6a

Signed-off-by: Stavros Foteinopoulos <[email protected]>

fix version suffix

8217814

Signed-off-by: Stavros Foteinopoulos <[email protected]>

fix version suffix 2

2a8c9ca

Signed-off-by: Stavros Foteinopoulos <[email protected]>

weblate and others added 4 commits September 18, 2025 19:15

chore: Update NOTICE.txt file with updated dependencies (#2077)

b36d111

Co-authored-by: unified-ci-app[bot] <121569378+unified-ci-app[bot]@users.noreply.github.com>

fix entry license support in validation functions (#2081)

295c2cd

agarciamontoro requested a review from a team as a code owner September 18, 2025 17:15

agarciamontoro requested a review from calebroseland September 18, 2025 17:15

Empty commit

a53fc6c

agarciamontoro closed this Sep 18, 2025

agarciamontoro reopened this Sep 18, 2025

Merge branch 'master' into CLD-9414-build-playbooks-fips-compliant

4a22550

calebroseland mentioned this pull request Oct 15, 2025

MM-66217: Fix CI - dist for PRs from forks #2110

Open

2 tasks

mattermost-build added the Lifecycle/1:stale label Oct 17, 2025

agarciamontoro removed the Lifecycle/1:stale label Oct 28, 2025

lieut-data mentioned this pull request Oct 29, 2025

build using use-mattermost-build-server container #2139

Draft

		# Build directly in the FIPS container without external script
		# Create local cache directory for CI/ACT compatibility

		GO_FIPS ?= docker run --rm -v $(PWD):/plugin -v $(HOME)/.cache:/root/.cache -w /plugin -e GOFLAGS -e GO111MODULE $(FIPS_IMAGE) go
		GO_BUILD_TAGS_FIPS = fips

Add FIPS support to build process and update .gitignore #2049

Are you sure you want to change the base?

Add FIPS support to build process and update .gitignore #2049

Conversation

stafot commented Jul 18, 2025

Summary

Ticket Link

Checklist

Uh oh!

hmhealey left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

agnivade left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

esarafianou left a comment

Choose a reason for hiding this comment

Uh oh!

agarciamontoro commented Sep 12, 2025

Uh oh!

agarciamontoro commented Sep 18, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

stafot commented Sep 19, 2025

Uh oh!

agarciamontoro commented Sep 19, 2025

Uh oh!

agarciamontoro commented Sep 19, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

mattermost-build commented Oct 17, 2025

Uh oh!

dryrunsecurity bot commented Oct 28, 2025

Uh oh!

agarciamontoro commented Oct 28, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

10 participants

agarciamontoro commented Sep 18, 2025 •

edited

Loading

agarciamontoro commented Sep 19, 2025 •

edited

Loading