ci: publish the legacy FIPS images again (#54)

.github/workflows/docker-build-push-legacy.yml

@@ -0,0 +1,69 @@
+name: Build and publish legacy Docker images
+
+# filigran/python-fips and filigran/python-nodejs-fips, built from legacy/. Kept
+# rebuilt so that consumers still tracking them receive Alpine updates while they
+# migrate to the alpine-prefixed images. See the migration window in README.md.
+on:
+  push:
+    branches:
+      - main
+    paths:
+      - legacy/**
+      - .github/workflows/docker-build-push-legacy.yml
+  pull_request:
+    paths:
+      - legacy/**
+      - .github/workflows/docker-build-push-legacy.yml
+  schedule:
+    # Offset from the main build, which these images share nothing with.
+    - cron: "0 2 * * *"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: docker-build-push-legacy-${{ github.ref }}
+  cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}
+
+jobs:
+  build:
+    name: Build ${{ matrix.image }}
+    runs-on: ubuntu-26.04
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - image: filigran/python-fips
+            dockerfile: Dockerfile_python
+            tags: |
+              filigran/python-fips:python3.12
+              filigran/python-fips:latest
+          - image: filigran/python-nodejs-fips
+            dockerfile: Dockerfile_python_nodejs
+            tags: |
+              filigran/python-nodejs-fips:python3.12-nodejs24
+              filigran/python-nodejs-fips:latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v7
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v4
+
+      - name: Log in to Docker Hub
+        if: github.ref == 'refs/heads/main'
+        uses: docker/login-action@v4
+        with:
+          username: ${{ vars.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+
+      - name: Build ${{ matrix.image }}
+        uses: docker/build-push-action@v7
+        with:
+          context: legacy
+          file: legacy/${{ matrix.dockerfile }}
+          platforms: linux/amd64
+          pull: true
+          push: ${{ github.ref == 'refs/heads/main' }}
+          tags: ${{ matrix.tags }}

.github/workflows/docker-build-push.yml

@@ -4,7 +4,11 @@ on:
   push:
     branches:
       - main
+    paths-ignore:
+      - legacy/**
   pull_request:
+    paths-ignore:
+      - legacy/**
   schedule:
     # Daily rebuild, to pick up upstream Alpine security updates.
     - cron: "0 0 * * *"

README.md

@@ -19,6 +19,22 @@ Images are available at: https://hub.docker.com/r/filigran/alpine-python-nodejs-
 
 Images are available at: https://hub.docker.com/r/filigran/alpine-python-fips.
 
+## Migrating from `filigran/python-fips` and `filigran/python-nodejs-fips`
+
+Those two images are still built daily, from `legacy/`, so that consumers
+tracking them keep receiving updates while they migrate. They are a migration
+window, not a maintained line: their FIPS provider is built from the same sources
+as the OpenSSL libraries and therefore carries **no CMVP certificate** — which is
+what the images above fix. The legacy workflow is meant to be deleted.
+
+What changes when moving to the images above:
+
+* `npm` and `yarn` are gone, and so is the build toolchain (`rust`, `cargo`,
+  `gcc`) — an image that compiles native wheels has to install its own.
+* The FIPS provider comes from the OpenSSL 3.1.2 validated sources instead of the
+  same version as the libraries, so the set of accepted algorithms differs.
+* Node.js is 24, which the tag now states.
+
 ## Use the images
 
 * For Python, bindings are automatically mapped to the OpenSSL FIPS provider,
@@ -53,12 +69,3 @@ Error setting digest
 The FIPS provider reports `3.1.2` while the library reports the Alpine version.
 That difference is expected: the validated module is the provider, and it is
 supported across OpenSSL library releases.
-
-## Previous images
-
-`filigran/python-fips` and `filigran/python-nodejs-fips` are no longer published.
-They remain pullable at their last build but receive no further updates, so pin
-`filigran/alpine-python-fips` or `filigran/alpine-python-nodejs-fips` instead.
-They differ: `npm`, `yarn` and the build toolchain are not installed, and the
-FIPS provider is built from the OpenSSL 3.1.2 validated sources rather than from
-the same sources as the libraries, so the set of accepted algorithms differs.

legacy/Dockerfile_python

@@ -0,0 +1,65 @@
+FROM alpine:3.23 AS base
+
+ARG OPENSSL_VERSION=3.6.4
+ARG PYTHON_VERSION=3.12.14
+
+ENV PATH /usr/local/bin:$PATH
+ENV LANG C.UTF-8
+
+# Install OpenSSL FIPS
+RUN set -ex \
+    && apk upgrade --no-cache \
+    && apk add --no-cache --virtual .build-deps make gcc libgcc musl-dev linux-headers perl vim \
+    && wget https://www.openssl.org/source/openssl-${OPENSSL_VERSION}.tar.gz \
+    && tar -xf openssl-${OPENSSL_VERSION}.tar.gz \
+    && cd openssl-${OPENSSL_VERSION} \
+    && ./Configure enable-fips shared enable-ec_nistp_64_gcc_128 \
+    && make \
+    && make install \
+    && make install_fips \
+    && cp -a /etc/ssl/certs/* /usr/local/ssl/certs/ \
+    && cp -a /etc/ssl/cert.pem /usr/local/ssl/ \
+    && apk del .build-deps \
+    && cd .. \
+    && rm -rf openssl-${OPENSSL_VERSION}.tar.gz openssl-${OPENSSL_VERSION}
+
+COPY openssl.cnf /etc/ssl/openssl.cnf
+
+ENV OPENSSL_FIPS=1
+ENV OPENSSL_DIR=/usr/local
+ENV OPENSSL_CONF=/etc/ssl/openssl.cnf
+ENV OPENSSL_MODULES=/usr/local/lib64/ossl-modules
+
+ENV LDFLAGS="-L/usr/local/lib/ -L/usr/local/lib64/"
+ENV LD_LIBRARY_PATH="/usr/local/lib/:/usr/local/lib64/"
+ENV CPPFLAGS="-I/usr/local/include -I/usr/local/include/openssl"
+ENV CFLAGS="-I/usr/local/include"
+
+# Install Python
+RUN set -ex \
+    && apk add --no-cache --virtual .build-deps make gcc libgcc musl-dev linux-headers perl vim tcl-dev tk-dev bzip2-dev zlib-dev libffi-dev cups-dev krb5-dev yaml-dev sqlite-dev libffi-dev libxml2-dev libxslt-dev \
+    && wget https://www.python.org/ftp/python/${PYTHON_VERSION}/Python-${PYTHON_VERSION}.tgz \
+    && tar -xvf Python-${PYTHON_VERSION}.tgz \
+    && cd Python-${PYTHON_VERSION} \
+    && ./configure --enable-optimizations --enable-shared --with-ensurepip=no \
+    && make \
+    && make install \
+    && cd .. \
+    && apk del .build-deps \
+    && ln -sf /usr/local/bin/idle3 /usr/local/bin/idle \
+    && ln -sf /usr/local/bin/pydoc3 /usr/local/bin/pydoc \
+    && ln -sf /usr/local/bin/python3 /usr/local/bin/python \
+    && ln -sf /usr/local/bin/python3-config /usr/local/bin/python-config \
+    && rm -f Python-${PYTHON_VERSION}.tgz \
+    && rm -rf Python-${PYTHON_VERSION}
+
+# Install deps
+RUN set -ex \
+    && apk add --no-cache libintl libffi rust cargo pkgconfig
+
+RUN set -ex \
+    && apk add --no-cache curl \
+    && curl https://bootstrap.pypa.io/get-pip.py -o get-pip.py \
+    && python3 get-pip.py \
+    && rm get-pip.py \
+    && pip install cryptography --no-binary cryptography

legacy/Dockerfile_python_nodejs

@@ -0,0 +1,68 @@
+FROM alpine:3.23 AS base
+
+ARG OPENSSL_VERSION=3.6.4
+ARG PYTHON_VERSION=3.12.14
+
+ENV PATH /usr/local/bin:$PATH
+ENV LANG C.UTF-8
+
+# Install OpenSSL FIPS
+RUN set -ex \
+    && apk upgrade --no-cache \
+    && apk add --no-cache --virtual .build-deps make gcc libgcc musl-dev linux-headers perl vim \
+    && wget https://www.openssl.org/source/openssl-${OPENSSL_VERSION}.tar.gz \
+    && tar -xf openssl-${OPENSSL_VERSION}.tar.gz \
+    && cd openssl-${OPENSSL_VERSION} \
+    && ./Configure enable-fips shared enable-ec_nistp_64_gcc_128 \
+    && make \
+    && make install \
+    && make install_fips \
+    && cp -a /etc/ssl/certs/* /usr/local/ssl/certs/ \
+    && cp -a /etc/ssl/cert.pem /usr/local/ssl/ \
+    && apk del .build-deps \
+    && cd .. \
+    && rm -rf openssl-${OPENSSL_VERSION}.tar.gz openssl-${OPENSSL_VERSION}
+
+COPY openssl.cnf /etc/ssl/openssl.cnf
+
+ENV OPENSSL_FIPS=1
+ENV OPENSSL_DIR=/usr/local
+ENV OPENSSL_CONF=/etc/ssl/openssl.cnf
+ENV OPENSSL_MODULES=/usr/local/lib64/ossl-modules
+
+ENV LDFLAGS="-L/usr/local/lib/ -L/usr/local/lib64/"
+ENV LD_LIBRARY_PATH="/usr/local/lib/:/usr/local/lib64/"
+ENV CPPFLAGS="-I/usr/local/include -I/usr/local/include/openssl"
+ENV CFLAGS="-I/usr/local/include"
+
+# Install Python
+RUN set -ex \
+    && apk add --no-cache --virtual .build-deps make gcc libgcc musl-dev linux-headers perl vim tcl-dev tk-dev bzip2-dev zlib-dev libffi-dev cups-dev krb5-dev yaml-dev sqlite-dev libffi-dev libxml2-dev libxslt-dev \
+    && wget https://www.python.org/ftp/python/${PYTHON_VERSION}/Python-${PYTHON_VERSION}.tgz \
+    && tar -xvf Python-${PYTHON_VERSION}.tgz \
+    && cd Python-${PYTHON_VERSION} \
+    && ./configure --enable-optimizations --enable-shared --with-ensurepip=no \
+    && make \
+    && make install \
+    && cd .. \
+    && apk del .build-deps \
+    && ln -sf /usr/local/bin/idle3 /usr/local/bin/idle \
+    && ln -sf /usr/local/bin/pydoc3 /usr/local/bin/pydoc \
+    && ln -sf /usr/local/bin/python3 /usr/local/bin/python \
+    && ln -sf /usr/local/bin/python3-config /usr/local/bin/python-config \
+    && rm -f Python-${PYTHON_VERSION}.tgz \
+    && rm -rf Python-${PYTHON_VERSION}
+
+# Install deps
+RUN set -ex \
+    && apk add --no-cache libintl libffi rust cargo pkgconfig
+
+RUN set -ex \
+    && apk add --no-cache curl \
+    && curl https://bootstrap.pypa.io/get-pip.py -o get-pip.py \
+    && python3 get-pip.py \
+    && rm get-pip.py \
+    && pip install cryptography --no-binary cryptography
+
+RUN set -ex \
+    && apk add nodejs npm yarn