feat(hardening) Harden the CFN handler

.github/workflows/presubmit.yml

@@ -7,56 +7,66 @@ on:
 
 env:
   GO_VERSION: 1.23.x
+  ZIG_VERSION: 0.13.0
   GOLINT_ARGS: -v --allow-parallel-runners --timeout=10m --disable errcheck
 
 jobs:
-  test:
+  build:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout ⤵️
         uses: actions/checkout@v4
 
+      - name: Version 🔢
+        shell: bash
+        id: version
+        run: |
+          if [ "${{ github.event_name }}" == "pull_request" ]; then
+            echo "GIT_SHA_SHORT="$(echo "${{ github.event.pull_request.head.sha }}" | head -c 8)"" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+          echo "GIT_SHA_SHORT="$(git log --format="%H" -n 1 | head -c 8)"" >> "$GITHUB_OUTPUT"
+
       - name: Setup Go 🛠️
         uses: actions/setup-go@v5
         with:
           go-version: ${{ env.GO_VERSION }}
 
-      - name: Test pkg library 🔎
+      - name: Setup Zig 🛠️
+        uses: goto-bus-stop/setup-zig@v2
+        with:
+          version: ${{ env.ZIG_VERSION }}
+
+      - name: Test pkg library 🧪
         run: |
           cd pkg
-          go test ./...
+          go test -race -mod=readonly ./...
 
-      - name: Test CloudFormation runtime 🔎
+      - name: Test 🧪
         run: |
           cd runtimes/cloudformation
-          go test ./...
-
-      - name: Lint pkg library 🪥
-        uses: golangci/golangci-lint-action@v6
-        with:
-          version: v1.60
-          working-directory: ./pkg
-          args: ${{ env.GOLINT_ARGS }}
-
-      - name: Lint CloudFormation runtime 🪥
+          go test -race -mod=readonly ./...
+
+      - name: Lint 🪥
         uses: golangci/golangci-lint-action@v6
         with:
           version: v1.60
           working-directory: ./runtimes/cloudformation/cmd/handler
           args: ${{ env.GOLINT_ARGS }}
 
-  build:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout ⤵️
-        uses: actions/checkout@v4
-
-      - name: Setup Go 🛠️
-        uses: actions/setup-go@v5
+      - name: Run GoReleaser  🏗️
+        id: goreleaser
+        uses: goreleaser/goreleaser-action@v6
         with:
-          go-version: ${{ env.GO_VERSION }}
+          args: build --clean --snapshot --parallelism=1
+          workdir: ./runtimes/cloudformation
+        env:
+          BUILD_VERSION: ${{ steps.version.outputs.GIT_SHA_SHORT }}
+          GORELEASER_CURRENT_TAG: "0.0.0"
 
-      - name: Build handler 🏗️
-        run: |
-          cd runtimes/cloudformation/cmd/handler
-          go build .
+      - name: Archive Artifacts
+        uses: actions/upload-artifact@v4
+        with:
+          name: handler-${{ steps.version.outputs.GIT_SHA_SHORT }}
+          path: |
+            ./runtimes/cloudformation/dist

.github/workflows/release.yml

@@ -7,6 +7,7 @@ on:
 
 env:
   GO_VERSION: 1.23.x
+  ZIG_VERSION: 0.13.0
   GOLINT_ARGS: -v --allow-parallel-runners --timeout=10m --disable errcheck
 
 jobs:
@@ -21,40 +22,50 @@ jobs:
         with:
           go-version: ${{ env.GO_VERSION }}
 
-      - name: Test pkg library 🔎
+      - name: Setup Zig 🛠️
+        uses: goto-bus-stop/setup-zig@v2
+        with:
+          version: ${{ env.ZIG_VERSION }}
+
+      - name: Test pkg library 🧪
         run: |
           cd pkg
-          go test ./...
-
-      - name: Lint pkg library 🪥
-        uses: golangci/golangci-lint-action@v6
-        with:
-          version: v1.60
-          working-directory: ./pkg
-          args: ${{ env.GOLINT_ARGS }}
+          go test -race -mod=readonly ./...
 
-      - name: Test CloudFormation runtime 🔎
+      - name: Test 🧪
         run: |
           cd runtimes/cloudformation
-          go test ./...
-      
-      - name: Lint CloudFormation runtime 🪥
+          go test -race -mod=readonly ./...
+
+      - name: Lint 🪥
         uses: golangci/golangci-lint-action@v6
         with:
           version: v1.60
           working-directory: ./runtimes/cloudformation/cmd/handler
           args: ${{ env.GOLINT_ARGS }}
 
-      - name: Build handler 🏗️
-        run: |
-          cd runtimes/cloudformation/cmd/handler
-          go build .
+      - name: Run GoReleaser  🏗️
+        id: goreleaser
+        uses: goreleaser/goreleaser-action@v6
+        with:
+          args: build --clean --snapshot --parallelism=1
+          workdir: ./runtimes/cloudformation
+        env:
+          BUILD_VERSION: ${{ github.ref_name }}
+          GORELEASER_CURRENT_TAG: "0.0.0"
+
+      - name: Archive Artifacts
+        uses: actions/upload-artifact@v4
+        with:
+          name: handler-${{ github.ref_name }}
+          path: |
+            ./runtimes/cloudformation/dist
 
       - name: Create release 🌟
         uses: softprops/action-gh-release@v2
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         with:
           files: |
-            runtimes/cloudformation/cmd/handler/handler
+            ./runtimes/cloudformation/dist
           name: ${{ github.ref_name }}

.gitignore

@@ -1,6 +1,5 @@
 .idea/
 
-/runtimes/cloudformation/agent-kilt.zip
 /runtimes/cloudformation/cmd/cfn-apply-kilt/cfn-apply-kilt
 /runtimes/cloudformation/cmd/cfn-image-info/cfn-image-info
-/runtimes/cloudformation/cmd/handler/handler
+/runtimes/cloudformation/dist

runtimes/cloudformation/.goreleaser.yml

@@ -0,0 +1,60 @@
+version: 2
+
+project_name: launcher
+
+archives:
+  - id: launcher
+    formats: ["binary"]
+
+builds:
+  - id: default
+    no_unique_dist_dir: true
+    binary: handler/handler-{{ .Os }}-{{ .Arch }}
+    main: ./cmd/handler
+    goos:
+      - linux
+    goarch:
+      - amd64
+      - arm64
+    goamd64:
+      - v1
+    mod_timestamp: "{{ .CommitTimestamp }}"
+    env:
+      - CGO_ENABLED=0
+    ldflags:
+      - -s -w
+      - -X main.version={{ .Version }}
+      - -X main.commit={{ .Commit }}
+      - -X main.date={{ .Date }}
+
+  - id: fips
+    no_unique_dist_dir: true
+    binary: handler-fips/handler-{{ .Os }}-{{ .Arch }}
+    main: ./cmd/handler
+    goos:
+      - linux
+    goarch:
+      - amd64
+      - arm64
+    goamd64:
+      - v1
+    mod_timestamp: "{{ .CommitTimestamp }}"
+    tags:
+      - fips
+    env:
+      - GOEXPERIMENT=boringcrypto
+      - CGO_ENABLED=1
+      - >-
+        {{- if and (eq .Os "linux") (eq .Arch "amd64") }}CC=zig c++ -target x86_64-linux-gnu{{- end }}
+        {{- if and (eq .Os "linux") (eq .Arch "arm64") }}CC=zig c++ -target aarch64-linux-gnu{{- end }}
+      - >-
+        {{- if and (eq .Os "linux") (eq .Arch "amd64") }}CXX=zig c++ -target x86_64-linux-gnu{{- end }}
+        {{- if and (eq .Os "linux") (eq .Arch "arm64") }}CXX=zig c++ -target aarch64-linux-gnu{{- end }}
+    ldflags:
+      - -s -w
+      - -X main.version={{ .Version }}
+      - -X main.commit={{ .Commit }}
+      - -X main.date={{ .Date }}
+
+snapshot:
+  version_template: "{{ .Env.BUILD_VERSION }}"

runtimes/cloudformation/cmd/handler/fips.go

@@ -0,0 +1,5 @@
+//go:build boringcrypto
+
+package main
+
+import _ "crypto/tls/fipsonly"