Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Multiple validations per binary #1

Merged
merged 2 commits into from
Oct 31, 2024
Merged

Multiple validations per binary #1

merged 2 commits into from
Oct 31, 2024

Conversation

davdhacs
Copy link

No description provided.

rhmdnd and others added 2 commits October 7, 2024 16:11
@rhmdnd
CMP-2734: Detect usage of x/crypto
bd73a4b 
The x/crypto module isn't compatible with FIPS. Let's write a check to
see if it is in the symbols for a given binary. Ideally, this should
help us find areas where we can remove x/crypto usage altogether.
@davdhacs
dont stop validatin'
7e3909a 
hold on
@davdhacs davdhacs merged commit 0552df5 into main Oct 31, 2024
@davdhacs
Copy link
Author

Test run at https://github.com/stackrox/stackrox/actions/runs/11605860184/job/32358261471
I think it does not continue on all types of validations yet.
This looks correct for a roxctl binary:

I1031 20:14:56.136659    7890 scan.go:461] "scanning failed" image="quay.io/rhacs-eng/main:4.6.x-832-g3ee6976d32-amd64" path="/assets/downloads/cli/roxctl-linux-amd64" error="go binary is not CGO_ENABLED" component="ubi8-minimal-container" tag="" rpm="" status="failed"
I1031 20:14:56.136690    7890 scan.go:461] "scanning failed" image="quay.io/rhacs-eng/main:4.6.x-832-g3ee6976d32-amd64" path="/assets/downloads/cli/roxctl-linux-amd64" error="x_cgo_init or _cgo_topofstack not found" component="ubi8-minimal-container" tag="" rpm="" status="failed"
I1031 20:14:56.136707    7[89](https://github.com/stackrox/stackrox/actions/runs/11605860184/job/32358261471#step:6:90)0 scan.go:461] "scanning failed" image="quay.io/rhacs-eng/main:4.6.x-832-g3ee6976d32-amd64" path="/assets/downloads/cli/roxctl-linux-amd64" error="go binary does not contain required symbol(s)" component="ubi8-minimal-container" tag="" rpm="" status="failed"
I1031 20:14:56.136719    78[90](https://github.com/stackrox/stackrox/actions/runs/11605860184/job/32358261471#step:6:91) scan.go:461] "scanning failed" image="quay.io/rhacs-eng/main:4.6.x-832-g3ee6976d32-amd64" path="/assets/downloads/cli/roxctl-linux-amd64" error="executable is not dynamically linked" component="ubi8-minimal-container" tag="" rpm="" status="failed"
I1031 20:14:56.136726    7890 scan.go:461] "scanning failed" image="quay.io/rhacs-eng/main:4.6.x-832-g3ee6976d32-amd64" path="/assets/downloads/cli/roxctl-linux-amd64" error="go binary has no build tags set (should have strictfipsruntime)" component="ubi8-minimal-container" tag="" rpm="" status="failed"
I1031 20:14:56.136735    7890 scan.go:461] "scanning failed" image="quay.io/rhacs-eng/main:4.6.x-832-g3ee6976d32-amd64" path="/assets/downloads/cli/roxctl-linux-amd64" error="detected a library that is incompatible with FIPS, check to make sure it is not performing any cryptographic operations" component="ubi8-minimal-container" tag="" rpm="" status="failed"

@davdhacs davdhacs deleted the multiple-validations-per-binary branch November 1, 2024 20:16
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
2 participants
@davdhacs @rhmdnd