feat(crypto): Enable FIPS-only mode

Makefile

@@ -11,6 +11,9 @@ go-test-app-dir := ./src/acceptance/assets/app/go_app
 go_modules := $(shell find . -maxdepth 6 -name "*.mod" -exec dirname {} \; | sed 's|\./src/||' | sort)
 all_modules := $(go_modules) db scheduler
 
+# Enable the boringcrypto experiment to use the Go BoringCrypto library, which implements FIPS 140-2 validated cryptographic algorithms.
+export GOEXPERIMENT = boringcrypto
+
 MVN_OPTS = "-Dmaven.test.skip=true"
 OS := $(shell . /etc/lsb-release &>/dev/null && echo $${DISTRIB_ID} || uname)
 db_type := postgres

jobs/scheduler/templates/scheduler.yml.erb

@@ -133,7 +133,7 @@ client:
     key-store: /var/vcap/jobs/scheduler/config/certs/scalingengine/client.p12
     key-store-password: 123456
     key-store-type: PKCS12
-    protocol: TLSv1.3
+    protocol: TLSv1.2
     trust-store: /var/vcap/jobs/scheduler/config/certs/scalingengine/cacerts
     trust-store-password: 123456
 ############################################################

src/autoscaler/Makefile

@@ -1,5 +1,6 @@
 SHELL := /bin/bash
 .SHELLFLAGS := -eu -o pipefail -c
+.ONESHELL:
 MAKEFLAGS := -s
 aes_terminal_font_yellow := \e[38;2;255;255;0m
 aes_terminal_reset := \e[0m
@@ -11,6 +12,10 @@ PACKAGE_DIRS = $(shell go list './...' | grep --invert-match --regexp='/vendor/'
 
 # `CGO_ENABLED := 1` is required to enforce dynamic linking which is a requirement of dynatrace.
 CGO_ENABLED := 1
+
+# Enable the boringcrypto experiment to use the Go BoringCrypto library, which implements FIPS 140-2 validated cryptographic algorithms.
+export GOEXPERIMENT = boringcrypto
+
 BUILDTAGS :=
 export GOWORK=off
 BUILDFLAGS := -ldflags '-linkmode=external'
@@ -93,7 +98,7 @@ build-%: ${openapi-generated-clients-and-servers-dir} ${openapi-generated-client
 	@CGO_ENABLED=$(CGO_ENABLED) go build $(BUILDTAGS) $(BUILDFLAGS) -o build/$* $*/cmd/$*/main.go
 
 
-build: $(addprefix build-,$(binaries))
+build: $(addprefix build-,$(binaries)) validate-fips-only-mode
 
 build_tests: $(addprefix build_test-,$(test_dirs))
 
@@ -109,6 +114,16 @@ build_test-%: generate-fakes
 		 go test -c -o $${test_file} $${package};\
 	 done;
 
+validate-fips-only-mode: $(binaries)
+	@echo "# Validating that the binaries are built with boringcrypto in FIPS-only mode"
+	@for binary in $(binaries); do
+		# See https://pkg.go.dev/crypto/internal/boring/sig for details on the signature checked here.
+		if [[ $$(go tool nm build/$$binary | grep -c 'crypto/internal/boring/sig.FIPSOnly') -eq 0 ]]; then
+			echo "Binary $$binary is not built with boringcrypto in FIPS-only mode";
+			exit 1;
+		fi;
+	done
+
 check: fmt lint build test
 
 test: generate-fakes

src/autoscaler/api/cmd/api/main.go

@@ -28,6 +28,8 @@ import (
 	"github.com/tedsuo/ifrit"
 	"github.com/tedsuo/ifrit/grouper"
 	"github.com/tedsuo/ifrit/sigmon"
+
+	_ "crypto/tls/fipsonly"
 )
 
 func main() {

src/autoscaler/eventgenerator/cmd/eventgenerator/main.go

@@ -25,6 +25,8 @@ import (
 	"github.com/tedsuo/ifrit"
 	"github.com/tedsuo/ifrit/grouper"
 	"github.com/tedsuo/ifrit/sigmon"
+
+	_ "crypto/tls/fipsonly"
 )
 
 func main() {

src/autoscaler/integration/scheduler_application.template.yml

@@ -7,7 +7,7 @@ client:
         key-store: {{ .TestCertDir }}/scheduler.p12
         key-store-password: 123456
         key-store-type: PKCS12
-        protocol: TLSv1.3
+        protocol: TLSv1.2
         trust-store: {{ .TestCertDir }}/autoscaler.truststore
         trust-store-password: 123456
 endpoints:

src/autoscaler/metricsforwarder/cmd/metricsforwarder/main.go

@@ -25,6 +25,8 @@ import (
 	"github.com/tedsuo/ifrit/sigmon"
 
 	"code.cloudfoundry.org/app-autoscaler/src/autoscaler/metricsforwarder/manager"
+
+	_ "crypto/tls/fipsonly"
 )
 
 func main() {

src/autoscaler/metricsgateway/cmd/metricsgateway/main.go

@@ -25,6 +25,8 @@ import (
 	"github.com/tedsuo/ifrit"
 	"github.com/tedsuo/ifrit/grouper"
 	"github.com/tedsuo/ifrit/sigmon"
+
+	_ "crypto/tls/fipsonly"
 )
 
 func main() {

src/autoscaler/metricsserver/cmd/metricsserver/main.go

@@ -21,6 +21,8 @@ import (
 	"github.com/tedsuo/ifrit"
 	"github.com/tedsuo/ifrit/grouper"
 	"github.com/tedsuo/ifrit/sigmon"
+
+	_ "crypto/tls/fipsonly"
 )
 
 func main() {

src/autoscaler/operator/cmd/operator/main.go

@@ -21,6 +21,8 @@ import (
 	"github.com/tedsuo/ifrit"
 	"github.com/tedsuo/ifrit/grouper"
 	"github.com/tedsuo/ifrit/sigmon"
+
+	_ "crypto/tls/fipsonly"
 )
 
 func main() {

src/autoscaler/scalingengine/cmd/scalingengine/main.go

@@ -24,6 +24,8 @@ import (
 	"github.com/tedsuo/ifrit"
 	"github.com/tedsuo/ifrit/grouper"
 	"github.com/tedsuo/ifrit/sigmon"
+
+	_ "crypto/tls/fipsonly"
 )
 
 func main() {