Add FIPS support for RHEL targets

.gitignore

@@ -133,3 +133,5 @@
 /go1.20.3.src.tar.gz
 /go1.20.4.src.tar.gz
 /go1.20.5.src.tar.gz
+/go1.20.5-1-openssl-fips.tar.gz
+/go1.20.4-3-openssl-fips.tar.gz

golang-prelink.conf

@@ -0,0 +1,3 @@
+# there are ELF files in src which are testdata and shouldn't be modified
+-b /usr/lib/golang/src
+-b /usr/lib64/golang/src

golang.spec

@@ -38,6 +38,13 @@
 
 # Golang build options.
 
+# Disable FIPS by default
+%global fips 0
+# Enable FIPS by default in RHEL
+%if 0%{?rhel}
+%global fips 1
+%endif
+
 # Build golang using external/internal(close to cgo disabled) linking.
 %ifarch %{ix86} x86_64 ppc64le %{arm} aarch64 s390x
 %global external_linker 1
@@ -73,10 +80,6 @@
 %global shared 0
 %endif
 
-# Pre build std lib with -race enabled
-# Disabled due to 1.20 new cache usage, see 1.20 upstream release notes
-%global race 0
-
 # Fedora GOROOT
 %global goroot          /usr/lib/%{name}
 
@@ -102,15 +105,16 @@
 %global gohostarch  s390x
 %endif
 
-# Comment out go_prerelease and go_patch as needed
 %global go_api 1.20
+# Use only for prerelease versions
 #global go_prerelease rc3
-%global go_patch 5
+%global go_patch 4
-
 %global go_version %{go_api}%{?go_patch:.%{go_patch}}%{?go_prerelease:~%{go_prerelease}}
 %global go_source %{go_api}%{?go_patch:.%{go_patch}}%{?go_prerelease}
+# Go FIPS package release
+%global pkg_release 3
 
-# For rpmdev-bumpspec and releng automation
+# For rpmdev-bumpspec and releng automation.
 %global baserelease 1
  
 Name:           golang
@@ -121,8 +125,16 @@ Summary:        The Go Programming Language
 License:        BSD and Public Domain
 URL:            https://go.dev
 Source0:        https://go.dev/dl/go%{go_source}.src.tar.gz
+# Go's FIPS mode bindings are now provided as a standalone
+# module instead of in tree.  This makes it easier to see
+# the actual changes vs upstream Go.  The module source is
+# located at https://github.com/golang-fips/openssl-fips,
+# And pre-genetated patches to set up the module for a given
+# Go release are located at https://github.com/golang-fips/go.
+# making a source conditional creates odd behaviors so for now, include FIPS always
+Source1:        https://github.com/golang-fips/go/archive/refs/tags/go%{go_source}-%{pkg_release}-openssl-fips.tar.gz
 # make possible to override default traceback level at build time by setting build tag rpm_crashtraceback
-Source1:        fedora.go
+Source2:        fedora.go
 
 # The compiler is written in Go. Needs go(1.4+) compiler for build.
 %if !%{golang_bootstrap}
@@ -130,16 +142,34 @@ BuildRequires:  gcc-go >= 5
 %else
 BuildRequires:  golang > 1.4
 %endif
+
+# Install hostname(1) or net-tools(1) depending on the OS version
 %if 0%{?rhel} > 6 || 0%{?fedora} > 0
 BuildRequires:  hostname
 %else
 BuildRequires:  net-tools
 %endif
-# for tests
+
-BuildRequires:  pcre-devel, glibc-static, perl-interpreter, procps-ng
+# If FIPS is enabled, we need openssl-devel
+%if %{fips}
+BuildRequires:  openssl-devel
+%endif
+
+BuildRequires: pcre-devel, glibc-static
+
+# For running the tests on Fedora
+%if 0%{?fedora}
+BuildRequires:  perl-interpreter, procps-ng
+%endif
+
+# For running the tests on RHEL
+%if 0%{?rhel}
+BuildRequires:  perl
+%endif
 
 Provides:       go = %{version}-%{release}
 
+%if 0%{?fedora}
 # Bundled/Vendored provides generated by bundled-deps.sh based on the in tree module data
 # - in version filed substituted with . per versioning guidelines
 Provides: bundled(golang(github.com/google/pprof)) = 0.0.0.20221118152302.e6195bd50e26
@@ -153,6 +183,7 @@ Provides: bundled(golang(golang.org/x/sys)) = 0.3.0
 Provides: bundled(golang(golang.org/x/term)) = 0.2.0
 Provides: bundled(golang(golang.org/x/text)) = 0.5.0
 Provides: bundled(golang(golang.org/x/tools)) = 0.3.1.0.20230118190848.070db2996ebe
+%endif
 
 Requires:       %{name}-bin = %{version}-%{release}
 Requires:       %{name}-src = %{version}-%{release}
@@ -171,14 +202,11 @@ Obsoletes:      %{name}-data < 1.1.1-4
 Obsoletes:      %{name}-vim < 1.4
 Obsoletes:      emacs-%{name} < 1.4
 
-# We stopped building the golang-race subpackage, so we need to to maintain the
-# update path.
-Obsoletes:      golang-race < 1.20~rc3-2
-
 # These are the only RHEL/Fedora architectures that we compile this package for
 ExclusiveArch:  %{golang_arches}
 
 Source100:      golang-gdbinit
+Source101:      golang-prelink.conf
 
 %description
 %{summary}.
@@ -280,22 +308,35 @@ Summary:        Golang shared object libraries
 %{summary}.
 %endif
 
-%if %{race}
-%package        race
-Summary:        Golang std library with -race enabled
-
-Requires:       %{name} = %{version}-%{release}
-
-%description    race
-%{summary}
-%endif
-
 %prep
 %autosetup -p1 -n go
+# Copy fedora.go to ./src/runtime/
+cp %{SOURCE2} ./src/runtime/
 
-cp %{SOURCE1} ./src/runtime/
+# If FIPS is enabled, install the FIPS source
+%if %{fips}
+    echo "Preparing FIPS patches"
+    pushd ..
+    tar -xf %{SOURCE1}
+    popd
+    # TODO Check here, this is failing due to the external linker flag? maybe, but it's clearly related to that according tho this commit:
+    # https://github.com/golang-fips/go/blob/main/patches/000-initial-setup.patch#L48
+    patch -p1 < ../go-go%{version}-%{pkg_release}-openssl-fips/patches/000-initial-setup.patch
+    patch -p1 < ../go-go%{version}-%{pkg_release}-openssl-fips/patches/001-initial-openssl-for-fips.patch
+
+    # Configure crypto tests
+    echo "Configure crypto tests"
+    pushd ../go-go%{version}-%{pkg_release}-openssl-fips
+    ln -s ../go go
+    ./scripts/configure-crypto-tests.sh
+    popd
+%endif
 
 %build
+# -x: print commands as they are executed
+# -e: exit immediately if a command exits with a non-zero status
+set -xe
+
 # print out system information
 uname -a
 cat /proc/cpuinfo
@@ -322,12 +363,21 @@ export CC="gcc"
 export CC_FOR_TARGET="gcc"
 export GOOS=linux
 export GOARCH=%{gohostarch}
+
+DEFAULT_GO_LD_FLAGS=""
 %if !%{external_linker}
-export GO_LDFLAGS="-linkmode internal"
+export GO_LDFLAGS="-linkmode internal $DEFAULT_GO_LD_FLAGS"
+%else
+# Only pass a select subset of the external hardening flags. We do not pass along
+# the default $RPM_LD_FLAGS as on certain arches Go does not fully, correctly support
+# building in PIE mode.
+export GO_LDFLAGS="\"-extldflags=-Wl,-z,now,-z,relro\" $DEFAULT_GO_LD_FLAGS"
 %endif
+
 %if !%{cgo_enabled}
 export CGO_ENABLED=0
 %endif
+
 ./make.bash --no-clean -v
 popd
 
@@ -336,12 +386,7 @@ popd
 GOROOT=$(pwd) PATH=$(pwd)/bin:$PATH go install -buildmode=shared -v -x std
 %endif
 
-%if %{race}
-GOROOT=$(pwd) PATH=$(pwd)/bin:$PATH go install -race -v -x std
-%endif
-
 %install
-echo "== 1 =="
 rm -rf $RPM_BUILD_ROOT
 # remove GC build cache
 rm -rf pkg/obj/go-build/*
@@ -354,7 +399,7 @@ mkdir -p $RPM_BUILD_ROOT%{goroot}
 # https://code.google.com/p/go/issues/detail?id=5830
 cp -apv api bin doc lib pkg src misc test VERSION \
    $RPM_BUILD_ROOT%{goroot}
-echo "== 2 =="
+
 # bz1099206
 find $RPM_BUILD_ROOT%{goroot}/src -exec touch -r $RPM_BUILD_ROOT%{goroot}/VERSION "{}" \;
 # and level out all the built archives
@@ -371,8 +416,11 @@ docs_list=$cwd/go-docs.list
 tests_list=$cwd/go-tests.list
 rm -f $src_list $pkg_list $docs_list $misc_list $tests_list $shared_list $race_list
 touch $src_list $pkg_list $docs_list $misc_list $tests_list $shared_list $race_list
+
+##################
+# Register files # 
+##################
 pushd $RPM_BUILD_ROOT%{goroot}
-  echo "== 3 =="
     find src/ -type d -a \( ! -name testdata -a ! -ipath '*/testdata/*' \) -printf '%%%dir %{goroot}/%p\n' >> $src_list
     find src/ ! -type d -a \( ! -ipath '*/testdata/*' -a ! -name '*_test.go' \) -printf '%{goroot}/%p\n' >> $src_list
 
@@ -386,7 +434,6 @@ pushd $RPM_BUILD_ROOT%{goroot}
     find misc/ ! -type d -printf '%{goroot}/%p\n' >> $misc_list
 
 %if %{shared}
-echo "== 4 =="
     mkdir -p %{buildroot}/%{_libdir}/
     mkdir -p %{buildroot}/%{golibdir}/
     for file in $(find .  -iname "*.so" ); do
@@ -402,16 +449,6 @@ echo "== 4 =="
     find pkg/*_dynlink/ -type d -printf '%%%dir %{goroot}/%p\n' >> $shared_list
     find pkg/*_dynlink/ ! -type d -printf '%{goroot}/%p\n' >> $shared_list
 %endif
-
-echo "== 5 =="
-
-%if %{race}
-
-    find pkg/*_race/ -type d -printf '%%%dir %{goroot}/%p\n' >> $race_list
-    find pkg/*_race/ ! -type d -printf '%{goroot}/%p\n' >> $race_list
-
-%endif
-
     find test/ -type d -printf '%%%dir %{goroot}/%p\n' >> $tests_list
     find test/ ! -type d -printf '%{goroot}/%p\n' >> $tests_list
     find src/ -type d -a \( -name testdata -o -ipath '*/testdata/*' \) -printf '%%%dir %{goroot}/%p\n' >> $tests_list
@@ -420,7 +457,6 @@ echo "== 5 =="
     find lib/ -type d -printf '%%%dir %{goroot}/%p\n' >> $tests_list
     find lib/ ! -type d -printf '%{goroot}/%p\n' >> $tests_list
 popd
-echo "== 6 =="
 # remove the doc Makefile
 rm -rfv $RPM_BUILD_ROOT%{goroot}/doc/Makefile
 
@@ -435,7 +471,7 @@ mkdir -p $RPM_BUILD_ROOT%{gopath}/src/github.com
 mkdir -p $RPM_BUILD_ROOT%{gopath}/src/bitbucket.org
 mkdir -p $RPM_BUILD_ROOT%{gopath}/src/code.google.com/p
 mkdir -p $RPM_BUILD_ROOT%{gopath}/src/golang.org/x
-echo "== 7 =="
+
 # make sure these files exist and point to alternatives
 rm -f $RPM_BUILD_ROOT%{_bindir}/go
 ln -sf /etc/alternatives/go $RPM_BUILD_ROOT%{_bindir}/go
@@ -446,40 +482,74 @@ ln -sf /etc/alternatives/gofmt $RPM_BUILD_ROOT%{_bindir}/gofmt
 mkdir -p $RPM_BUILD_ROOT%{_sysconfdir}/gdbinit.d
 cp -av %{SOURCE100} $RPM_BUILD_ROOT%{_sysconfdir}/gdbinit.d/golang.gdb
 
-echo "== END OF INSTALL =="
+# prelink blacklist
+mkdir -p $RPM_BUILD_ROOT%{_sysconfdir}/prelink.conf.d
+cp -av %{SOURCE101} $RPM_BUILD_ROOT%{_sysconfdir}/prelink.conf.d/golang.conf
+
+%if %{fips}
+# Quick fix for the rhbz#2014704
+sed -i 's/const defaultGO_LDSO = `.*`/const defaultGO_LDSO = ``/' $RPM_BUILD_ROOT%{goroot}/src/internal/buildcfg/zbootstrap.go
+%endif
 
 %check
+echo ">>> check <<<"
 export GOROOT=$(pwd -P)
 export PATH="$GOROOT"/bin:"$PATH"
 cd src
 
+# Add some sanity checks.
+echo "GO VERSION:"
+go version
+
+echo "GO ENVIRONMENT:"
+go env
+
 export CC="gcc"
 export CFLAGS="$RPM_OPT_FLAGS"
 export LDFLAGS="$RPM_LD_FLAGS"
 %if !%{external_linker}
 export GO_LDFLAGS="-linkmode internal"
+%else
+export GO_LDFLAGS="-extldflags '$RPM_LD_FLAGS'"
 %endif
 %if !%{cgo_enabled} || !%{external_linker}
 export CGO_ENABLED=0
 %endif
-# workaround for https://github.com/golang/go/issues/39466 until it gests fixed
-# Commented until the patch is ready, this workaround suggested in the link above
-# doesn't work properly
-#ifarch aarch64
-#export CGO_CFLAGS="-mno-outline-atomics"
-#endif
 
 # make sure to not timeout
 export GO_TEST_TIMEOUT_SCALE=2
 
+export GO_TEST_RUN=""
+%ifarch aarch64
+  export GO_TEST_RUN="-run=!testshared"
+%endif
+
 %if %{fail_on_tests}
-./run.bash --no-rebuild -v -v -v -k
+    ./run.bash --no-rebuild -v -v -v -k $go_test_run
+
+    %if %{fips}
+        # tested25519vectors needs network connectivity but it should be cover by
+        # this test https://pkgs.devel.redhat.com/cgit/tests/golang/tree/regression/internal-testsuite/runtest.sh#n127
+
+        # run tests with fips enabled.
+        export GOLANG_FIPS=1
+        export OPENSSL_FORCE_FIPS_MODE=1
+        pushd crypto
+          # run all crypto tests but skip tls, we will run fips specific tls tests later
+          go test $(go list ./... | grep -v tls) -v
+          # check that signature functions have parity between boring and notboring
+          cgo_enabled=0 go test $(go list ./... | grep -v tls) -v
+        popd
+        # run all fips specific tls tests
+        pushd crypto/tls
+          go test -v -run "Boring"
+        popd
+    %endif
 %else
-./run.bash --no-rebuild -v -v -v -k || :
+    ./run.bash --no-rebuild -v -v -v -k || :
 %endif
 cd ..
 
-
 %post bin
 %{_sbindir}/update-alternatives --install %{_bindir}/go \
     go %{goroot}/bin/go 90 \
@@ -512,10 +582,12 @@ fi
 %dir %{gopath}/src/golang.org
 %dir %{gopath}/src/golang.org/x
 
-
 # gdbinit (for gdb debugging)
 %{_sysconfdir}/gdbinit.d
 
+# prelink blacklist
+%{_sysconfdir}/prelink.conf.d
+
 %files src -f go-src.list
 
 %files docs -f go-docs.list
@@ -534,13 +606,9 @@ fi
 %files shared -f go-shared.list
 %endif
 
-%if %{race}
-%files race -f go-race.list
-%endif
-
 %changelog
-* Tue Jun 06 2023 Alejandro Sáez <asm@redhat.com> - 1.20.5-1
+* Tue Jun 13 2023 Alejandro Sáez <asm@redhat.com> - 1.20.4-3
-- Update to go 1.20.5
+- Add FIPS support for RHEL targets
 
 * Tue May 02 2023 Alejandro Sáez <asm@redhat.com> - 1.20.4-1
 - Update to go1.20.4

sources

@@ -1 +1,2 @@
-SHA512 (go1.20.5.src.tar.gz) = 94cecb366cd9d9722b53e52ea3b0a5715a9e9dc21da0273dd3db9354557f71b9501b018125ef073dacc2e59125335f436cea1151cd8df0d60e2ad513f841905c
+SHA512 (go1.20.4.src.tar.gz) = 43898325bab48c24e533f360a2c7de356a8a56946602e727b5bcd4a62ff4f64fd750e2650032f7e0525b0699e40e506d79446e16838f097e6bdc2a16f10d81be
+SHA512 (go1.20.4-3-openssl-fips.tar.gz) = b3c3a61e44e61c0e4feb1c499d194630d0c9466cfd06daf86e523c0b54933f5a63d350dc0eef3f0f38dc30598fb1a636f14812a0d3d56f9673da1b9f373d5513