FIPS compliant v3.5.17-dd.2 build

[aneesh1]

What's changing in .github/workflows/dd-build.yaml

• Original build job is split up into build-arm64 and build-amd64
  • Doing this b/c we're running with CGO_ENABLED=1 and I was having issues cross-compiling. The build-arm64 job runs on an arm64 machine and build-amd64 job runs on an amd64 machine. I use a matrix strategy for both rather than hardcoding environment variables.
• Artifacts uploaded separately under different names etcd_output_arm64 and etcd_output_amd64
• Release job depends on both build-amd64 and build-arm64
• Artifact Download Adjustment
  • We introduced a job Set artifact name to set the name of the artifact to be downloaded properly in releaseassets.
• Combine checksums and then upload (because we're running two separate jobs on two separate runners)
• Renamed releaseassets --> releaseassetsarm

New script ./scripts/build-release-single-target

• Very similar to ./scripts/build-binary
• Builds etcd and creates a .tar.gz release artifact.
• Takes in variables TARGET_OS and TARGET_ARCH to build the binary

Modifications to build.sh

• New variable:GO_ADDITIONAL_VARS included in GO_BUILD_ENV
• Needed so we can pass GOEXPERIMENT=boringcrypto
• I tried doing export GOEXPERIMENT=boringcrypto, but it didn't work (see 57dc0c7 and https://github.com/DataDog/etcd/actions/runs/13862426254/job/38793868704)

Added fips.go to etcd, etcdctl, etcdutl main packages

[datadog-datadog-prod-us1]

🟠 Code Vulnerability

Workflow depends on a GitHub actions pinned by tag instead of a hash. (...read more)

Pin GitHub Actions by commit hash to ensure supply chain security.

Using a branch (@main) or tag (@v1) allows for implicit updates, which can introduce unexpected or malicious changes. Instead, always pin actions to a full length commit SHA. You can find the commit SHA for the latest tag from the action’s repository and ensure frequent updates via auto-updaters such as dependabot. Include a comment with the corresponding full-length SemVer tag for clarity:

      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

    

[datadog-datadog-prod-us1]

🟠 Code Vulnerability

Workflow depends on a GitHub actions pinned by tag instead of a hash. (...read more)

Pin GitHub Actions by commit hash to ensure supply chain security.

Using a branch (@main) or tag (@v1) allows for implicit updates, which can introduce unexpected or malicious changes. Instead, always pin actions to a full length commit SHA. You can find the commit SHA for the latest tag from the action’s repository and ensure frequent updates via auto-updaters such as dependabot. Include a comment with the corresponding full-length SemVer tag for clarity:

      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

    

[datadog-datadog-prod-us1]

🟠 Code Vulnerability

Workflow depends on a GitHub actions pinned by tag instead of a hash. (...read more)

Pin GitHub Actions by commit hash to ensure supply chain security.

Using a branch (@main) or tag (@v1) allows for implicit updates, which can introduce unexpected or malicious changes. Instead, always pin actions to a full length commit SHA. You can find the commit SHA for the latest tag from the action’s repository and ensure frequent updates via auto-updaters such as dependabot. Include a comment with the corresponding full-length SemVer tag for clarity:

      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

    

[datadog-datadog-prod-us1]

🟠 Code Vulnerability

Workflow depends on a GitHub actions pinned by tag instead of a hash. (...read more)

Pin GitHub Actions by commit hash to ensure supply chain security.

Using a branch (@main) or tag (@v1) allows for implicit updates, which can introduce unexpected or malicious changes. Instead, always pin actions to a full length commit SHA. You can find the commit SHA for the latest tag from the action’s repository and ensure frequent updates via auto-updaters such as dependabot. Include a comment with the corresponding full-length SemVer tag for clarity:

      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

    

[aneesh1]

% go tool nm etcd-v3.5.17-dd.2-fips-test-linux-arm64/etcd | grep -i 'crypto/internal/boring/sig.FIPSOnly'
  17b500 T crypto/internal/boring/sig.FIPSOnly.abi0
% go tool nm etcd-v3.5.17-dd.2-fips-test-linux-arm64/etcdctl | grep -i 'crypto/internal/boring/sig.FIPSOnly'
  176eb0 T crypto/internal/boring/sig.FIPSOnly.abi0
% go tool nm etcd-v3.5.17-dd.2-fips-test-linux-arm64/etcdutl | grep -i 'crypto/internal/boring/sig.FIPSOnly'
  42c2c0 T crypto/internal/boring/sig.FIPSOnly.abi0
% go tool nm etcd-v3.5.17-dd.2-fips-test-linux-amd64/etcd | grep -i 'crypto/internal/boring/sig.FIPSOnly'
  5fde80 T crypto/internal/boring/sig.FIPSOnly.abi0
% go tool nm etcd-v3.5.17-dd.2-fips-test-linux-amd64/etcdctl | grep -i 'crypto/internal/boring/sig.FIPSOnly'
  5f9c20 T crypto/internal/boring/sig.FIPSOnly.abi0
% go tool nm etcd-v3.5.17-dd.2-fips-test-linux-amd64/etcdutl | grep -i 'crypto/internal/boring/sig.FIPSOnly'
  8cdcc0 T crypto/internal/boring/sig.FIPSOnly.abi0