-
Story
-
Resolution: Done
-
Major
-
None
-
None
As a developer, I want to ensure that downstream SSCSI container images are built with FIPS compliance
-
- Use ART's builder and base image [We're already using that]
- CGO_ENABLED=1
- GOFLAGS="-tags=strictfipsruntime"
- GOEXPERIMENT=strictfipsruntime
- Exclude any of -ldflags '-extldflags "-static"' as dynamic linking cannot honor those linker flags
- https://github.com/openshift/secrets-store-csi-driver/blob/main/Dockerfile.openshift
- https://github.com/openshift/secrets-store-csi-driver-operator/blob/main/Dockerfile.openshift
Note: In https://github.com/openshift/secrets-store-csi-driver-operator/blob/main/Makefile we are using github.com/openshift/build-machinery-go. So, there is no direct access of make build unlike SSCSI Driver where make build is directly configurable.