chore: actually build fips on alpine

Author: apiarian-datadog

bottlecap/Cargo.toml

@@ -69,6 +69,12 @@ lto = true
 codegen-units = 1
 strip = true
 
+[profile.release-alpine-arm64-fips]
+inherits = "release"
+# Unfortunately opt-level "z" does not work for building aws-lc-fips-sys on
+# Alpine for ARM with FIPS enabled.
+opt-level = 3
+
 [features]
 default = ["reqwest/rustls-tls", "dogstatsd/default"]
 fips = [

images/Dockerfile.bottlecap.alpine.compile

@@ -4,7 +4,7 @@ ARG PLATFORM
 ARG FIPS
 
 # Install dependencies
-RUN apk add --no-cache curl gcc musl-dev make unzip bash autoconf automake libtool g++ go cmake linux-headers clang
+RUN apk add --no-cache curl gcc musl-dev make unzip bash autoconf automake libtool g++ perl go cmake linux-headers;
 
 SHELL ["/bin/bash", "-c"]
 
@@ -28,21 +28,21 @@ COPY ./bottlecap/Cargo.lock /tmp/dd/bottlecap/Cargo.lock
 #
 # Added `-C link-arg=-lgcc` for alpine.
 ENV RUSTFLAGS="-C panic=abort -C link-arg=-lgcc"
-ENV AWS_LC_FIPS_SYS_CC=clang
-ENV AWS_LC_FIPS_SYS_CXX=clang++
 
 WORKDIR /tmp/dd/bottlecap
-# we can't currently compile successfully in alpine for fips mode, so we force
-# fallback in alpine fips to the go agent.
 RUN --mount=type=cache,target=/root/.cargo/registry \
+    export PROFILE="release"; \
     if [ "$FIPS" = "1" ]; then \
-        export FEATURES="default,force_fallback"; \
+        export FEATURES=fips; \
+        if [ "$PLATFORM" = "aarch64" ]; then \
+            export PROFILE="release-alpine-arm64-fips"; \
+        fi \
     else \
         export FEATURES=default; \
     fi; \
     env; \
-    cargo +stable build --no-default-features --features $FEATURES --release --target $PLATFORM-unknown-linux-musl;
-RUN cp /tmp/dd/bottlecap/target/$PLATFORM-unknown-linux-musl/release/bottlecap /tmp/dd/bottlecap/bottlecap
+    cargo +stable build --verbose --no-default-features --features $FEATURES --profile $PROFILE --target $PLATFORM-unknown-linux-musl; \
+    cp /tmp/dd/bottlecap/target/$PLATFORM-unknown-linux-musl/$PROFILE/bottlecap /tmp/dd/bottlecap/bottlecap
 
 # Use the smallest image possible
 FROM scratch