[feature] build with boring crypto where available (#344)

* updated workflow to goreleaser builds

.dockerignore

@@ -1,8 +0,0 @@
-*
-!cmd
-!go.mod
-!go.sum
-!internal
-!Makefile
-!pkg
-!static

.github/workflows/release.yaml

@@ -7,10 +7,10 @@ on:
       - '*'
 
 jobs:
-  go-release:
-    name: Go Release Job
+  goreleaser:
+    name: GoReleaser Job
     runs-on: ubuntu-latest
-    timeout-minutes: 30
+    timeout-minutes: 60
     steps:
       - name: Checkout
         uses: actions/checkout@v4
@@ -28,33 +28,6 @@ jobs:
           go-version-file: go.mod
           check-latest: true
 
-      - name: Run Go Releaser
-        uses: goreleaser/goreleaser-action@v6
-        with:
-          distribution: goreleaser
-          version: "~> v2"
-          args: "release --clean -p 1"
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          HOMEBREW_TAP_GITHUB_TOKEN: ${{ secrets.HOMEBREW_TAP_GITHUB_TOKEN }}
-
-  container-release:
-    name: Container Release Job
-    runs-on: ubuntu-latest
-    needs: [go-release]
-    timeout-minutes: 30
-    continue-on-error: true
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-
-      - name: Configure Git
-        run: |
-          git config user.name "github-actions[bot]"
-          git config user.email "github-actions[bot]@users.noreply.github.com"
-
       - name: Set Up QEMU
         uses: docker/setup-qemu-action@v3
 
@@ -75,20 +48,13 @@ jobs:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
 
-      - name: Build and Push Release Container to GitHub Container Registry
-        uses: docker/build-push-action@v5
+      - name: Run GoReleaser
+        uses: goreleaser/goreleaser-action@v6
         with:
-          context: .
-          target: release
-          platforms: linux/amd64,linux/arm64
-          push: true
-          tags: ghcr.io/${{ github.repository }}:${{ github.ref_name }}, docker.io/hauler/hauler:${{ github.ref_name }}
-
-      - name: Build and Push Debug Container to GitHub Container Registry
-        uses: docker/build-push-action@v5
-        with:
-          context: .
-          target: debug
-          platforms: linux/amd64,linux/arm64
-          push: true
-          tags: ghcr.io/${{ github.repository }}-debug:${{ github.ref_name }}, docker.io/hauler/hauler-debug:${{ github.ref_name }}
+          distribution: goreleaser
+          version: "~> v2"
+          args: "release --clean --parallelism 1 --timeout 60m"
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          HOMEBREW_TAP_GITHUB_TOKEN: ${{ secrets.HOMEBREW_TAP_GITHUB_TOKEN }}
+          DOCKER_CLI_EXPERIMENTAL: "enabled"

.github/workflows/tests.yaml

@@ -31,7 +31,6 @@ jobs:
           go-version-file: go.mod
           check-latest: true
 
-
       - name: Install Go Releaser
         uses: goreleaser/goreleaser-action@v6
         with:
@@ -183,8 +182,10 @@ jobs:
       - name: Verify - hauler store extract
         run: |
           hauler store extract --help
-          # verify via hauler store content
+          # verify via extracting hauler store content
           hauler store extract hauler/hauler-manifest-local.yaml:latest
+          # view extracted content from store
+          cat hauler-manifest-local.yaml
 
       - name: Verify - hauler store info
         run: |
@@ -209,6 +210,8 @@ jobs:
           hauler store save
           # verify via save with filename
           hauler store save --filename store.tar.zst
+          # verify via save with filename and platform (amd64)
+          hauler store save --filename store-amd64.tar.zst --platform linux/amd64
 
       - name: Remove Hauler Store Contents
         run: |
@@ -220,8 +223,10 @@ jobs:
           hauler store load --help
           # verify via load
           hauler store load haul.tar.zst
-          # verify via load with different temp directory
+          # verify via load with filename and temp directory
           hauler store load store.tar.zst --tempdir /opt
+          # verify via load with filename and platform (amd64)
+          hauler store load store-amd64.tar.zst
 
       - name: Verify Hauler Store Contents
         run: |
@@ -230,9 +235,21 @@ jobs:
           # verify store directory structure
           tree -hC store
 
+      - name: Verify - docker load
+        run: |
+          docker load --help
+          # verify via load
+          docker load --input store-amd64.tar.zst
+
+      - name: Verify Docker Images Contents
+        run: |
+          docker images --help
+          # verify images
+          docker images --all
+
       - name: Remove Hauler Store Contents
         run: |
-          rm -rf store haul.tar.zst store.tar.zst
+          rm -rf store haul.tar.zst store.tar.zst store-amd64.tar.zst
           hauler store info
 
       - name: Verify - hauler store sync

.goreleaser.yaml

@@ -3,8 +3,14 @@ version: 2
 project_name: hauler
 before:
   hooks:
+    - rm -rf cmd/hauler/binaries
+    - mkdir -p cmd/hauler/binaries
+    - touch cmd/hauler/binaries/file
     - go mod tidy
     - go mod download
+    - go fmt ./...
+    - go vet ./...
+    - go test ./... -cover -race -covermode=atomic -coverprofile=coverage.out
     - rm -rf cmd/hauler/binaries
 
 release:
@@ -16,7 +22,7 @@ env:
   - cosign_version=v2.2.3+carbide.3
 
 builds:
-  - main: cmd/hauler/main.go
+  - dir: ./cmd/hauler/.
     goos:
       - linux
       - darwin
@@ -29,8 +35,11 @@ builds:
     hooks:
       pre:
         - wget -P cmd/hauler/binaries/ https://github.com/hauler-dev/cosign/releases/download/{{ .Env.cosign_version }}/cosign-{{ .Os }}-{{ .Arch }}{{ if eq .Os "windows" }}.exe{{ end }}
+      post:
+        - rm -rf cmd/hauler/binaries
     env:
       - CGO_ENABLED=0
+      - GOEXPERIMENT=boringcrypto
 
 universal_binaries:
   - replace: false
@@ -47,3 +56,75 @@ brews:
       token: "{{ .Env.HOMEBREW_TAP_GITHUB_TOKEN }}"
     directory: Formula
     description: "Hauler CLI"
+
+dockers:
+  - id: hauler-amd64
+    goos: linux
+    goarch: amd64
+    use: buildx
+    dockerfile: Dockerfile
+    build_flag_templates:
+      - "--platform=linux/amd64"
+      - "--target=release"
+    image_templates:
+      - "docker.io/hauler/hauler-amd64:{{ .Version }}"
+      - "ghcr.io/hauler-dev/hauler-amd64:{{ .Version }}"
+  - id: hauler-arm64
+    goos: linux
+    goarch: arm64
+    use: buildx
+    dockerfile: Dockerfile
+    build_flag_templates:
+      - "--platform=linux/arm64"
+      - "--target=release"
+    image_templates:
+      - "docker.io/hauler/hauler-arm64:{{ .Version }}"
+      - "ghcr.io/hauler-dev/hauler-arm64:{{ .Version }}"
+  - id: hauler-debug-amd64
+    goos: linux
+    goarch: amd64
+    use: buildx
+    dockerfile: Dockerfile
+    build_flag_templates:
+      - "--platform=linux/amd64"
+      - "--target=debug"
+    image_templates:
+      - "docker.io/hauler/hauler-debug-amd64:{{ .Version }}"
+      - "ghcr.io/hauler-dev/hauler-debug-amd64:{{ .Version }}"
+  - id: hauler-debug-arm64
+    goos: linux
+    goarch: arm64
+    use: buildx
+    dockerfile: Dockerfile
+    build_flag_templates:
+      - "--platform=linux/arm64"
+      - "--target=debug"
+    image_templates:
+      - "docker.io/hauler/hauler-debug-arm64:{{ .Version }}"
+      - "ghcr.io/hauler-dev/hauler-debug-arm64:{{ .Version }}"
+
+docker_manifests:
+  - id: hauler-docker
+    use: docker
+    name_template: "docker.io/hauler/hauler:{{ .Version }}"
+    image_templates:
+      - "docker.io/hauler/hauler-amd64:{{ .Version }}"
+      - "docker.io/hauler/hauler-arm64:{{ .Version }}"
+  - id: hauler-ghcr
+    use: docker
+    name_template: "ghcr.io/hauler-dev/hauler:{{ .Version }}"
+    image_templates:
+      - "ghcr.io/hauler-dev/hauler-amd64:{{ .Version }}"
+      - "ghcr.io/hauler-dev/hauler-arm64:{{ .Version }}"
+  - id: hauler-debug-docker
+    use: docker
+    name_template: "docker.io/hauler/hauler-debug:{{ .Version }}"
+    image_templates:
+      - "docker.io/hauler/hauler-debug-amd64:{{ .Version }}"
+      - "docker.io/hauler/hauler-debug-arm64:{{ .Version }}"
+  - id: hauler-debug-ghcr
+    use: docker
+    name_template: "ghcr.io/hauler-dev/hauler-debug:{{ .Version }}"
+    image_templates:
+      - "ghcr.io/hauler-dev/hauler-debug-amd64:{{ .Version }}"
+      - "ghcr.io/hauler-dev/hauler-debug-arm64:{{ .Version }}"

Dockerfile

@@ -1,11 +1,8 @@
 # builder stage
-FROM registry.suse.com/bci/golang:1.23 AS builder
+FROM registry.suse.com/bci/bci-base:15.5 AS builder
 
-RUN zypper --non-interactive install make bash wget ca-certificates
-
-COPY . /build
-WORKDIR /build
-RUN make build
+# fetched from goreleaser build proccess
+COPY hauler /hauler
 
 RUN echo "hauler:x:1001:1001::/home/hauler:" > /etc/passwd \
 && echo "hauler:x:1001:hauler" > /etc/group \
@@ -25,7 +22,7 @@ COPY --from=builder --chown=hauler:hauler /tmp/. /tmp
 COPY --from=builder --chown=hauler:hauler /store/. /store
 COPY --from=builder --chown=hauler:hauler /registry/. /registry
 COPY --from=builder --chown=hauler:hauler /fileserver/. /fileserver
-COPY --from=builder --chown=hauler:hauler /build/bin/hauler /
+COPY --from=builder --chown=hauler:hauler /hauler /hauler
 
 USER hauler
 ENTRYPOINT [ "/hauler" ]
@@ -37,7 +34,7 @@ COPY --from=builder /var/lib/ca-certificates/ca-bundle.pem /etc/ssl/certs/ca-cer
 COPY --from=builder /etc/passwd /etc/passwd
 COPY --from=builder /etc/group /etc/group
 COPY --from=builder --chown=hauler:hauler /home/hauler/. /home/hauler
-COPY --from=builder --chown=hauler:hauler /build/bin/hauler /bin/hauler
+COPY --from=builder --chown=hauler:hauler /hauler /usr/local/bin/hauler
 
 RUN apk --no-cache add curl
 

Makefile

@@ -4,32 +4,34 @@
 SHELL=/bin/bash
 
 # set go variables
-GO_FILES=$(shell go list ./... | grep -v /vendor/)
+GO_FILES=./...
 GO_COVERPROFILE=coverage.out
 
-# set cosign variables
-COSIGN_VERSION=v2.2.3+carbide.3
-
 # set build variables
 BIN_DIRECTORY=bin
 DIST_DIRECTORY=dist
 BINARIES_DIRECTORY=cmd/hauler/binaries
 
-# builds hauler for current platform
-# references other targets
-build: install fmt vet test
-	goreleaser build --clean --snapshot --single-target
+# local build of hauler for current platform
+# references/configuration from .goreleaser.yaml
+build:
+	goreleaser build --clean --snapshot --parallelism 1 --timeout 60m --single-target
 
-# builds hauler for all platforms
-# references other targets
-build-all: install fmt vet test
-	goreleaser build --clean --snapshot
+# local build of hauler for all platforms
+# references/configuration from .goreleaser.yaml
+build-all:
+	goreleaser build --clean --snapshot --parallelism 1 --timeout 60m
+
+# local release of hauler for all platforms
+# references/configuration from .goreleaser.yaml
+release:
+	goreleaser release --clean --snapshot --parallelism 1 --timeout 60m
 
 # install depedencies
 install:
 	rm -rf $(BINARIES_DIRECTORY)
 	mkdir -p $(BINARIES_DIRECTORY)
-	wget -P $(BINARIES_DIRECTORY) https://github.com/hauler-dev/cosign/releases/download/$(COSIGN_VERSION)/cosign-$(shell go env GOOS)-$(shell go env GOARCH)
+	touch cmd/hauler/binaries/file
 	go mod tidy
 	go mod download
 	CGO_ENABLED=0 go install ./cmd/...

cmd/hauler/boringcrypto.go

@@ -0,0 +1,6 @@
+//go:build boringcrypto
+// +build boringcrypto
+
+package main
+
+import _ "crypto/tls/fipsonly"

cmd/hauler/cli/store/extract.go

@@ -23,10 +23,12 @@ func ExtractCmd(ctx context.Context, o *flags.ExtractOpts, s *store.Layout, ref
 		return err
 	}
 
+	// use the repository from the context and the identifier from the reference
+	repo := r.Context().RepositoryStr() + ":" + r.Identifier()
+
 	found := false
 	if err := s.Walk(func(reference string, desc ocispec.Descriptor) error {
-
-		if !strings.Contains(reference, r.Name()) {
+		if !strings.Contains(reference, repo) {
 			return nil
 		}
 		found = true

internal/flags/save.go

@@ -12,5 +12,5 @@ func (o *SaveOpts) AddFlags(cmd *cobra.Command) {
 	f := cmd.Flags()
 
 	f.StringVarP(&o.FileName, "filename", "f", "haul.tar.zst", "(Optional) Specify the name of outputted archive")
-	f.StringVarP(&o.Platform, "platform", "p", "", "(Optional) Specifiy the platform of the images for the outputted archive... i.e. linux/amd64 (defaults to all)")
+	f.StringVarP(&o.Platform, "platform", "p", "", "(Optional) Specify the platform for runtime imports... i.e. linux/amd64 (unspecified implies all)")
 }