f6712ca417
Unlike fips_140_3, fips will be a (FIPS) version-agnostic build tag. The listener support will remain in 140-3 only, but the IsFIPS() check should apply regardless of FIPS version. We add two FIPS-only build files which validate the constraints of FIPS builds here: fips must be specified with either fips_140_2 or fips_140_3 build tags, and fips and cgo must also be specified together. Additionally, using only a version-specific FIPS build tag without the version-agnostic FIPS tag should be a failure. Signed-off-by: Alexander Scheel <alex.scheel@hashicorp.com>
39 lines
1.7 KiB
Go
39 lines
1.7 KiB
Go
//go:build (!fips && (fips_140_2 || fips_140_3)) || (fips && !fips_140_2 && !fips_140_3) || (fips_140_2 && fips_140_3)
|
|
|
|
package constants
|
|
|
|
import "C"
|
|
|
|
// This function is the equivalent of an external (CGo) function definition,
|
|
// without implementation in any imported or built library. This results in
|
|
// a linker err if the above build constraints are satisfied:
|
|
//
|
|
// /home/cipherboy/GitHub/cipherboy/vault-enterprise/helper/constants/fips_build_check.go:10: undefined reference to `github.com/hashicorp/vault/helper/constants.VaultFIPSBuildRequiresVersionAgnosticTagAndOneVersionTag'
|
|
//
|
|
// This indicates that a build error has occurred due to mismatched tags.
|
|
//
|
|
// In particular, we use this to enforce the following restrictions on build
|
|
// tags:
|
|
//
|
|
// - If a versioned fips_140_* tag is specified, the unversioned tag must
|
|
// also be.
|
|
// - If the unversioned tag is specified, a versioned tag must be.
|
|
// - Both versioned flags cannot be specified at the same time.
|
|
//
|
|
// In the unlikely event that a FFI implementation for this function exists
|
|
// in the future, it should be renamed to a new function which does not
|
|
// exist.
|
|
//
|
|
// This approach was chosen above the other implementation in fips_cgo_check.go
|
|
// because this version does not break static analysis tools: most tools do not
|
|
// cross the CGo boundary and thus do not know that the below function is
|
|
// missing an implementation. However, in the other file, the function call is
|
|
// not marked as CGo (in part large because the lack of a cgo build tag
|
|
// prohibits us from using the same technique) and thus it must be a Go
|
|
// declaration, that is missing.
|
|
func VaultFIPSBuildRequiresVersionAgnosticTagAndOneVersionTag()
|
|
|
|
func init() {
|
|
VaultFIPSBuildRequiresVersionAgnosticTagAndOneVersionTag()
|
|
}
|