Skip to content

Commit 15917fd

Browse files
pennypacker-hepennypacker-he
committed
[patch] Harden Vault initialization durability
1 parent 7602d5e commit 15917fd

12 files changed

Lines changed: 1875 additions & 752 deletions

‎.dockerignore‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
.git
2+
.github
3+
ci
4+
main_test.go
5+
vault-init

‎.github/workflows/github-release.yaml‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -8,8 +8,9 @@ on:
88
jobs:
99
release:
1010
if: github.event.pull_request.merged == true && !contains(github.event.pull_request.title, 'skip-release')
11-
uses: libops/.github/.github/workflows/bump-release.yaml@main
11+
uses: libops/.github/.github/workflows/bump-release.yaml@578137212ead4ab4059e95df17fa30e9b7ac4aed
12+
with:
13+
workflow_file: goreleaser.yaml
1214
permissions:
1315
contents: write
1416
actions: write
15-
secrets: inherit

‎.github/workflows/goreleaser.yaml‎

Lines changed: 44 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,32 +1,71 @@
11
name: goreleaser
2+
23
on:
34
workflow_dispatch:
45
push:
56
tags:
67
- "*"
78

89
permissions:
9-
contents: write
10+
contents: read
1011

1112
jobs:
13+
test:
14+
runs-on: ubuntu-24.04
15+
steps:
16+
- name: Checkout
17+
uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
18+
with:
19+
persist-credentials: false
20+
21+
- name: Set up Go
22+
uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6
23+
with:
24+
go-version-file: go.mod
25+
26+
- name: Verify tagged source
27+
run: |
28+
go mod download
29+
go mod verify
30+
go mod tidy -diff
31+
go test -race ./...
32+
1233
goreleaser:
34+
needs: test
1335
runs-on: ubuntu-24.04
36+
permissions:
37+
contents: write
1438
steps:
1539
- name: Checkout
1640
uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
1741
with:
1842
fetch-depth: 0
43+
persist-credentials: false
1944

2045
- name: Set up Go
21-
uses: actions/setup-go@4dc6199c7b1a012772edbd06daecab0f50c9053c # v6
46+
uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6
2247
with:
23-
go-version: ">=1.25.6"
48+
go-version-file: go.mod
2449

2550
- name: Run GoReleaser
26-
uses: goreleaser/goreleaser-action@e435ccd777264be153ace6237001ef4d979d3a7a # v6
51+
uses: goreleaser/goreleaser-action@f06c13b6b1a9625abc9e6e439d9c05a8f2190e94 # v7
2752
with:
2853
distribution: goreleaser
29-
version: latest
54+
version: v2.17.0
3055
args: release --clean
3156
env:
3257
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
58+
59+
publish-images:
60+
if: github.ref_type == 'tag'
61+
needs:
62+
- test
63+
- goreleaser
64+
uses: ./.github/workflows/lint-test-build-push.yml
65+
permissions:
66+
contents: read
67+
id-token: write
68+
packages: write
69+
secrets:
70+
GCLOUD_OIDC_POOL: ${{ secrets.GCLOUD_OIDC_POOL }}
71+
GSA: ${{ secrets.GSA }}

‎.github/workflows/lint-test-build-push.yml‎

Lines changed: 98 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -1,30 +1,116 @@
11
name: build-push
2+
23
on:
4+
workflow_call:
5+
secrets:
6+
GCLOUD_OIDC_POOL:
7+
required: false
8+
GSA:
9+
required: false
10+
pull_request:
311
push:
12+
branches:
13+
- main
414
workflow_dispatch:
15+
16+
permissions:
17+
contents: read
18+
519
jobs:
620
test:
7-
permissions:
8-
contents: read
921
runs-on: ubuntu-24.04
1022
steps:
1123
- uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
24+
with:
25+
persist-credentials: false
26+
27+
- uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6
28+
with:
29+
go-version-file: go.mod
30+
31+
- name: Verify dependencies
32+
run: |
33+
go mod download
34+
go mod verify
35+
go mod tidy -diff
36+
37+
- name: Check GoReleaser configuration
38+
uses: goreleaser/goreleaser-action@f06c13b6b1a9625abc9e6e439d9c05a8f2190e94 # v7
39+
with:
40+
distribution: goreleaser
41+
version: v2.17.0
42+
args: check
43+
44+
- name: Lint
45+
uses: golangci/golangci-lint-action@ba0d7d2ec06a0ea1cb5fa41b2e4a3ab91d21278a # v9
46+
with:
47+
version: v2.12.2
1248

13-
- uses: actions/setup-go@4dc6199c7b1a012772edbd06daecab0f50c9053c # v6
49+
- name: Test
50+
run: go test -race ./...
51+
52+
image-check:
53+
if: github.event_name == 'pull_request'
54+
strategy:
55+
fail-fast: false
56+
matrix:
57+
runner:
58+
- ubuntu-24.04
59+
- ubuntu-24.04-arm
60+
runs-on: ${{ matrix.runner }}
61+
steps:
62+
- uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
1463
with:
15-
go-version: ">=1.25.3"
64+
persist-credentials: false
65+
66+
- uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3
1667

17-
- uses: golangci/golangci-lint-action@1e7e51e771db61008b38414a730f564565cf7c20 # v9
68+
- name: Resolve native platform
69+
id: platform
70+
run: |
71+
set -euo pipefail
72+
case "$RUNNER_ARCH" in
73+
X64) platform=amd64 ;;
74+
ARM64) platform=arm64 ;;
75+
*) echo "Unsupported runner architecture: $RUNNER_ARCH" >&2; exit 1 ;;
76+
esac
77+
echo "name=$platform" >> "$GITHUB_OUTPUT"
1878
19-
- name: Test with the Go CLI
20-
run: go test -v -race ./...
79+
- name: Build native image without credentials
80+
uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6
81+
with:
82+
context: .
83+
load: true
84+
platforms: linux/${{ steps.platform.outputs.name }}
85+
provenance: false
86+
push: false
87+
tags: vault-init:ci-${{ steps.platform.outputs.name }}
88+
89+
- name: Scan native image
90+
uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
91+
with:
92+
image-ref: vault-init:ci-${{ steps.platform.outputs.name }}
93+
format: table
94+
exit-code: "1"
95+
ignore-unfixed: true
96+
severity: HIGH,CRITICAL
97+
vuln-type: os,library
2198

22-
build-push:
23-
needs: [test]
24-
uses: libops/.github/.github/workflows/build-push.yaml@main
99+
publish:
100+
if: github.event_name != 'pull_request'
101+
needs: test
102+
uses: libops/.github/.github/workflows/build-push.yaml@578137212ead4ab4059e95df17fa30e9b7ac4aed
25103
with:
26-
docker-registry: "libops"
104+
ref: ${{ github.sha }}
105+
expected-main-sha: ${{ github.ref == 'refs/heads/main' && github.sha || '' }}
106+
additional-gar-registry: us-docker.pkg.dev/libops-images/public
107+
scan: true
108+
sign: true
109+
certificate-identity: https://github.com/libops/.github/.github/workflows/build-push.yaml@578137212ead4ab4059e95df17fa30e9b7ac4aed
27110
permissions:
28111
contents: read
112+
id-token: write
29113
packages: write
30-
secrets: inherit
114+
secrets:
115+
GCLOUD_OIDC_POOL: ${{ secrets.GCLOUD_OIDC_POOL }}
116+
GSA: ${{ secrets.GSA }}

‎.goreleaser.yml‎

Lines changed: 9 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,17 +1,19 @@
1-
before:
2-
hooks:
3-
- go mod tidy
1+
version: 2
2+
43
builds:
54
- binary: vault-init
65
env:
76
- CGO_ENABLED=0
7+
ldflags:
8+
- -s -w -X main.version={{ .Version }}
89
goos:
910
- linux
1011
- windows
1112
- darwin
1213

1314
archives:
14-
- format: tar.gz
15+
- formats:
16+
- tar.gz
1517
# this name template makes the OS and Arch compatible with the results of uname.
1618
name_template: >-
1719
{{ .ProjectName }}_
@@ -23,11 +25,12 @@ archives:
2325
# use zip for windows archives
2426
format_overrides:
2527
- goos: windows
26-
format: zip
28+
formats:
29+
- zip
2730
checksum:
2831
name_template: "checksums.txt"
2932
snapshot:
30-
name_template: "{{ incpatch .Version }}-next"
33+
version_template: "{{ incpatch .Version }}-next"
3134
changelog:
3235
sort: asc
3336
filters:

‎Dockerfile‎

Lines changed: 13 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,11 @@
1-
FROM golang:1.25.6@sha256:ce63a16e0f7063787ebb4eb28e72d477b00b4726f79874b3205a965ffd797ab2 AS builder
1+
FROM ghcr.io/libops/go:1.26.5@sha256:ea764e85e42a243217c621891123b3fda9374674c29d59785414fc6b15815b3d AS builder
22

3-
ENV GO111MODULE=on \
4-
CGO_ENABLED=0 \
5-
GOOS=linux \
6-
GOARCH=amd64
3+
SHELL ["/bin/ash", "-o", "pipefail", "-ex", "-c"]
4+
5+
ENV CGO_ENABLED=0 \
6+
GOOS=linux
7+
8+
ARG GIT_BRANCH=devel
79

810
WORKDIR /src
911

@@ -12,15 +14,16 @@ RUN --mount=type=cache,target=/go/pkg/mod \
1214
go mod download
1315

1416
COPY main.go .
15-
RUN go build \
16-
-a \
17+
RUN --mount=type=cache,target=/root/.cache/go-build \
18+
go build \
1719
-trimpath \
18-
-ldflags "-s -w -extldflags '-static'" \
19-
-tags 'osusergo netgo static_build' \
20+
-ldflags "-s -w -X main.version=${GIT_BRANCH}" \
21+
-tags "osusergo netgo" \
2022
-o /bin/vault-init \
2123
.
2224

2325
FROM scratch
2426
COPY --from=builder /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/
2527
COPY --from=builder /bin/vault-init /bin/vault-init
26-
CMD ["/bin/vault-init"]
28+
USER 65532:65532
29+
ENTRYPOINT ["/bin/vault-init"]

0 commit comments

Comments
 (0)