FIPS compliant v3.5.17-dd.3 build

[aneesh1]

What's changing in .github/workflows/dd-build.yaml

• Original build job is split up into build-arm64 and build-amd64
  • Doing this b/c we're running with CGO_ENABLED=1 and I was having issues cross-compiling. The build-arm64 job runs on an arm64 machine and build-amd64 job runs on an amd64 machine. I use a matrix strategy for both rather than hardcoding environment variables.
• Artifacts uploaded separately under different names etcd_output_arm64 and etcd_output_amd64
• Release job depends on both build-amd64 and build-arm64
• Artifact Download Adjustment
  • We introduced a job Set artifact name to set the name of the artifact to be downloaded properly in releaseassets.
• Combine checksums and then upload (because we're running two separate jobs on two separate runners)
• Renamed releaseassets --> releaseassetsarm

New script ./scripts/build-binary-single-target

• Very similar to ./scripts/build-binary
• Builds etcd and creates a .tar.gz release artifact.
• Takes in variables TARGET_OS and TARGET_ARCH to build the binary

Modifications to build.sh

• New variable:GO_EXPERIMENT included in GO_BUILD_ENV
• Needed so we can pass GOEXPERIMENT=boringcrypto
• I tried doing export GOEXPERIMENT=boringcrypto, but it didn't work (see 57dc0c7 and https://github.com/DataDog/etcd/actions/runs/13862426254/job/38793868704)

Added fips.go to etcd, etcdctl, etcdutl main packages

Details about cherry-picked commits:

• Trivy caught some security vulnerabilities in the go standard libraries, upgrading to 1.23.7 fixed this
• scripts/build-binary-single-target doesn't run with GOLDFLAGS so we can inspect the symbols and ensure that the binary is fips compliant
• Needed 1bb7e72 and d546bb3 b/c of https://github.blog/changelog/2024-04-16-deprecation-notice-v3-of-the-artifact-actions/

[datadog-datadog-prod-us1]

🟠 Code Vulnerability

Workflow depends on a GitHub actions pinned by tag instead of a hash. (...read more)

Pin GitHub Actions by commit hash to ensure supply chain security.

Using a branch (@main) or tag (@v1) allows for implicit updates, which can introduce unexpected or malicious changes. Instead, always pin actions to a full length commit SHA. You can find the commit SHA for the latest tag from the action’s repository and ensure frequent updates via auto-updaters such as dependabot. Include a comment with the corresponding full-length SemVer tag for clarity:

      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

    

[datadog-datadog-prod-us1]

🟠 Code Vulnerability

Workflow depends on a GitHub actions pinned by tag instead of a hash. (...read more)

Pin GitHub Actions by commit hash to ensure supply chain security.

Using a branch (@main) or tag (@v1) allows for implicit updates, which can introduce unexpected or malicious changes. Instead, always pin actions to a full length commit SHA. You can find the commit SHA for the latest tag from the action’s repository and ensure frequent updates via auto-updaters such as dependabot. Include a comment with the corresponding full-length SemVer tag for clarity:

      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

    

[datadog-datadog-prod-us1]

🟠 Code Vulnerability

Workflow depends on a GitHub actions pinned by tag instead of a hash. (...read more)

Pin GitHub Actions by commit hash to ensure supply chain security.

Using a branch (@main) or tag (@v1) allows for implicit updates, which can introduce unexpected or malicious changes. Instead, always pin actions to a full length commit SHA. You can find the commit SHA for the latest tag from the action’s repository and ensure frequent updates via auto-updaters such as dependabot. Include a comment with the corresponding full-length SemVer tag for clarity:

      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

    

[datadog-datadog-prod-us1]

🟠 Code Vulnerability

Workflow depends on a GitHub actions pinned by tag instead of a hash. (...read more)

Pin GitHub Actions by commit hash to ensure supply chain security.

Using a branch (@main) or tag (@v1) allows for implicit updates, which can introduce unexpected or malicious changes. Instead, always pin actions to a full length commit SHA. You can find the commit SHA for the latest tag from the action’s repository and ensure frequent updates via auto-updaters such as dependabot. Include a comment with the corresponding full-length SemVer tag for clarity:

      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

    

[badouralix]

Given we want to build one arch at a time, I don't think we have the choice but to fork scripts/build-binary into scripts/build-binary-single-target indeed