We're evaluating the options to enable FIPS compliance in our Golang app. (which is packaged as a container running on top of Amazon Linux on Fargate).

And I believe this fork is a valid option (assuming the underlying OpenSSL crypto is FIPS validated). 😄

This makes sense to me. 🙂 I found aws/containers-roadmap#659 that suggests Fargate container hosts may not be FIPS compliant, but I'm far from an authority on AWS. Container scenarios are definitely something we want this fork to support.

So the end game in my mind is: the Docker image for this project is capable to build a Golang application (i.e binary) that is FIPS compliant. The FIPS compliant is achieved by building the binary against FIPS-validated-OpenSSL-library.

Yep. I think the best way to use the image is as a "builder" stage in a multi-stage Dockerfile. That way, you can throw away the Go toolset and have a smaller app image.

One clarification: the builder stage doesn't actually have to compile against FIPS-compliant OpenSSL. The OpenSSL library is loaded in with dlopen, so all you need is a FIPS-compliant OpenSSL present in the final image.

Do you have end-to-end example from build, execute and validate the Golang binary/app for FIPS Compliance?

No, we haven't gone through this entire process through to certification yet. Validation is complicated--there's the basics that automation can catch, and things that it can't. More about that at #428.

We have a couple more docs here with more details about how our implementation works, and some notes about FIPS:
https://github.com/microsoft/go/tree/microsoft/main/eng/doc/fips
https://github.com/microsoft/go/tree/microsoft/main/eng/doc/fips/UserGuide.md

Docker image for microsoft/go #447

Description

arintoopenedon Feb 20, 2022

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

arinto
openedon Feb 20, 2022