feat(crypto): FIPS 140-3 compliant build and runtime checks (#12233)

# Which Problems Are Solved

Enable FIPS 140-3 compliant build.

# How the Problems Are Solved

- Add runtime config validation, if the FIPS flag is enabled fail the
application when a non-compliant hasher is used, or throw a warning when
a legacy verifier is used
- Add a build matrix for FIPS certified build:
  - Go binary is built with `GOFIPS140=certified`
- Login container uses a separate base:
[ubi9](https://catalog.redhat.com/en/software/containers/ubi9/ubi/615bcf606feffc5384e8452e)
from redhat which provides a FIPS certified OpenSSL (used by NodeJS TLS
stack)
- Non-FIPS images where already pushed to both Github Container Registry
and Google Artifact Repository (GAR). Fips images are only pushed to the
GAR.
- Tag versions are suffixed `-fips`. So on release the following images
will be additionally available:

```
europe-docker.pkg.dev/zitadel-common/zitadel-repo/zitadel-login:vX.Y.Z-fips
europe-docker.pkg.dev/zitadel-common/zitadel-repo/zitadel:vX.Y.Z-fips-debug
europe-docker.pkg.dev/zitadel-common/zitadel-repo/zitadel:vX.Y.Z-fips
```
  
# Other changes

- Bumb Go toolchain. At least v1.25.10 is required for a
GOFIPS140=certified setting.
 
# Additional Context

- Closes https://github.com/zitadel/zitadel/issues/4335
- Build [test
run](https://github.com/zitadel/zitadel/actions/runs/27253916052)
pushing FIPS and non-FIPS images

.github/workflows/lint_test_build.yml

@@ -58,7 +58,6 @@ jobs:
       - name: Lint, Test and Build
         env:
           NX_CLOUD_ACCESS_TOKEN: ${{ secrets.NX_CLOUD_ACCESS_TOKEN || secrets.NX_CLOUD_ACCESS_TOKEN_READONLY }}
-          #          NX_NATIVE_LOGGING: "nx::native::cache,nx::native::db"
           NX_DAEMON: "false"
           NX_DISABLE_DB: "true"
         run: pnpm nx affected --nxBail --targets lint test build --exclude @zitadel/docs

.github/workflows/pack.yml

@@ -40,7 +40,7 @@ jobs:
       semantic_version: ${{ inputs.semantic_version }}
       dry_run: true
 
-  pack:
+  pack-archives:
     runs-on:
       group: zitadel-public
     environment: ${{ github.ref_protected == 'true' && 'Protected' || null }}
@@ -67,10 +67,6 @@ jobs:
         with:
           node-version: ${{ inputs.node_version }}
           cache: "pnpm"
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
-        with:
-          version: v0.28.0
       - name: Install dependencies
         run: pnpm install --frozen-lockfile
       - name: Pack API and Login
@@ -88,11 +84,59 @@ jobs:
         with:
           name: zitadel-archives
           path: .artifacts/pack
+
+  docker:
+    runs-on:
+      group: zitadel-public
+    environment: ${{ github.ref_protected == 'true' && 'Protected' || null }}
+    needs: [version, pack-archives]
+    permissions:
+      contents: read
+      packages: write
+    strategy:
+      matrix:
+        include:
+          - gofips140: "off"
+            tag_suffix: ""
+            push_ghcr: true
+          - gofips140: "certified"
+            tag_suffix: "-fips"
+            push_ghcr: false
+    steps:
+      - name: Checkout Repository
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+          filter: tree:0
+      - name: Set up Go
+        uses: actions/setup-go@v6
+        with:
+          go-version-file: go.mod
+      - name: Set up pnpm
+        uses: pnpm/action-setup@v4
+        with:
+          run_install: false
+      - name: Set up Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: ${{ inputs.node_version }}
+          cache: "pnpm"
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+      - name: Build Linux API binaries
+        env:
+          ZITADEL_GOFIPS140: ${{ matrix.gofips140 }}
+          ZITADEL_VERSION: ${{ needs.version.outputs.version }}
+          NX_CLOUD_ACCESS_TOKEN: ${{ secrets.NX_CLOUD_ACCESS_TOKEN || secrets.NX_CLOUD_ACCESS_TOKEN_READONLY }}
+        run: pnpm nx run-many --nxBail -p @zitadel/api -t pack-linux-amd64,pack-linux-arm64
       - name: Set up QEMU
         uses: docker/setup-qemu-action@v3
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
+        with:
+          version: v0.28.0
       - name: Login to Docker registry
+        if: matrix.push_ghcr
         uses: docker/login-action@v3
         with:
           registry: ghcr.io
@@ -104,24 +148,36 @@ jobs:
           registry: europe-docker.pkg.dev
           username: _json_key_base64
           password: ${{ secrets.GCR_JSON_KEY_BASE64 }}
+      - name: Set API image names
+        id: api-images
+        run: |
+          if [ "${{ matrix.push_ghcr }}" = "true" ]; then
+            {
+              echo "${{ inputs.image_name_github_api }}"
+              echo "${{ inputs.image_name_google_api }}"
+            } > api-images.txt
+          else
+            echo "${{ inputs.image_name_google_api }}" > api-images.txt
+          fi
+          echo "list<<EOF" >> "$GITHUB_OUTPUT"
+          cat api-images.txt >> "$GITHUB_OUTPUT"
+          echo "EOF" >> "$GITHUB_OUTPUT"
       - name: Generate Standard Tags and Labels from the GitHub Context for the API Scratch Container Image
         id: scratch-meta
         uses: docker/metadata-action@v5
         with:
-          images: |
-            ${{ inputs.image_name_github_api }}
-            ${{ inputs.image_name_google_api }}
+          images: ${{ steps.api-images.outputs.list }}
           labels: ${{ env.default_labels}}
           tags: |
-            type=sha,prefix=,suffix=,format=long
+            type=sha,prefix=,suffix=${{ matrix.tag_suffix }},format=long
       - name: Build and Push the SHA-tagged API Scratch Container Image
         id: build-scratch
         uses: docker/build-push-action@v6
         timeout-minutes: 3
         with:
           context: .
-          cache-from: type=gha
-          cache-to: type=gha,mode=max
+          cache-from: type=gha,scope=api-scratch-${{ matrix.gofips140 }}
+          cache-to: type=gha,mode=max,scope=api-scratch-${{ matrix.gofips140 }}
           file: apps/api/Dockerfile
           target: final
           platforms: linux/amd64,linux/arm64
@@ -132,20 +188,19 @@ jobs:
         id: debug-meta
         uses: docker/metadata-action@v5
         with:
-          images: |
-            ${{ inputs.image_name_github_api }}
-            ${{ inputs.image_name_google_api }}
+          images: ${{ steps.api-images.outputs.list }}
           labels: ${{ env.default_labels}}
           tags: |
-            type=sha,prefix=,suffix=-debug,format=long
+            type=sha,prefix=,suffix=${{ matrix.tag_suffix }}-debug,format=long
       - name: Build and Push the SHA-tagged API Debug Container Image
+        if: matrix.push_ghcr
         id: build-debug
         uses: docker/build-push-action@v6
         timeout-minutes: 5
         with:
           context: .
-          cache-from: type=gha
-          cache-to: type=gha,mode=max
+          cache-from: type=gha,scope=api-debug-${{ matrix.gofips140 }}
+          cache-to: type=gha,mode=max,scope=api-debug-${{ matrix.gofips140 }}
           file: apps/api/Dockerfile
           target: builder
           platforms: linux/amd64,linux/arm64
@@ -153,7 +208,25 @@ jobs:
           labels: ${{ steps.debug-meta.outputs.labels }}
           tags: ${{ steps.debug-meta.outputs.tags }}
           outputs: type=image,name=${{ inputs.image_name_github_api }},name-canonical=true
+      - name: Build and Push the SHA-tagged API Debug Container Image (GAR only)
+        if: ${{ !matrix.push_ghcr }}
+        uses: docker/build-push-action@v6
+        timeout-minutes: 5
+        with:
+          context: .
+          cache-from: type=gha,scope=api-debug-${{ matrix.gofips140 }}
+          cache-to: type=gha,mode=max,scope=api-debug-${{ matrix.gofips140 }}
+          file: apps/api/Dockerfile
+          target: builder
+          platforms: linux/amd64,linux/arm64
+          push: true
+          labels: ${{ steps.debug-meta.outputs.labels }}
+          tags: ${{ steps.debug-meta.outputs.tags }}
+      - name: Build Login standalone
+        if: matrix.push_ghcr
+        run: pnpm nx run --nxBail @zitadel/login:build
       - name: Generate Standard Tags and Labels from the GitHub Context for the Login Container Image
+        if: matrix.push_ghcr
         id: login-meta
         uses: docker/metadata-action@v5
         with:
@@ -166,14 +239,42 @@ jobs:
           tags: |
             type=sha,prefix=,suffix=,format=long
       - name: Build and Push the SHA-tagged Login Container Image
+        if: matrix.push_ghcr
         id: build-login
         uses: docker/build-push-action@v6
         timeout-minutes: 3
         with:
           context: apps/login
-          cache-from: type=gha
-          cache-to: type=gha,mode=max
+          cache-from: type=gha,scope=login
+          cache-to: type=gha,mode=max,scope=login
           platforms: linux/amd64,linux/arm64
           push: true
           labels: ${{ steps.login-meta.outputs.labels }}
           tags: ${{ steps.login-meta.outputs.tags }}
+      - name: Build Login standalone
+        if: ${{ !matrix.push_ghcr }}
+        run: pnpm nx run --nxBail @zitadel/login:build
+      - name: Generate tags for FIPS Login image
+        if: ${{ !matrix.push_ghcr }}
+        id: login-fips-meta
+        uses: docker/metadata-action@v5
+        with:
+          images: ${{ inputs.image_name_google_login }}
+          labels: |
+            org.opencontainers.image.licenses=MIT
+            ${{ env.default_labels}}
+          tags: |
+            type=sha,prefix=,suffix=-fips,format=long
+      - name: Build and Push FIPS Login image (GAR only)
+        if: ${{ !matrix.push_ghcr }}
+        uses: docker/build-push-action@v6
+        timeout-minutes: 3
+        with:
+          context: apps/login
+          file: apps/login/Dockerfile.fips
+          cache-from: type=gha,scope=login-fips
+          cache-to: type=gha,mode=max,scope=login-fips
+          platforms: linux/amd64,linux/arm64
+          push: true
+          labels: ${{ steps.login-fips-meta.outputs.labels }}
+          tags: ${{ steps.login-fips-meta.outputs.tags }}

.github/workflows/release.yml

@@ -103,12 +103,21 @@ jobs:
         docker buildx imagetools create \
           --tag ${{ inputs.image_name_google_api }}:${{ needs.version.outputs.version }} \
           ${{ inputs.image_name_google_api }}:${{ github.sha }}
+        docker buildx imagetools create \
+          --tag ${{ inputs.image_name_google_api }}:${{ needs.version.outputs.version }}-fips \
+          ${{ inputs.image_name_google_api }}:${{ github.sha }}-fips
+        docker buildx imagetools create \
+          --tag ${{ inputs.image_name_google_api }}:${{ needs.version.outputs.version }}-fips-debug \
+          ${{ inputs.image_name_google_api }}:${{ github.sha }}-fips-debug
         docker buildx imagetools create \
           --tag ${{ inputs.image_name_github_login }}:${{ needs.version.outputs.version }} \
           ${{ inputs.image_name_github_login }}:${{ github.sha }}
         docker buildx imagetools create \
           --tag ${{ inputs.image_name_google_login }}:${{ needs.version.outputs.version }} \
           ${{ inputs.image_name_google_login }}:${{ github.sha }}
+        docker buildx imagetools create \
+          --tag ${{ inputs.image_name_google_login }}:${{ needs.version.outputs.version }}-fips \
+          ${{ inputs.image_name_google_login }}:${{ github.sha }}-fips
     -
       name: Publish latest
       if: ${{ github.ref_name == 'next' }}
@@ -122,6 +131,15 @@ jobs:
         docker buildx imagetools create \
           --tag ${{ inputs.image_name_github_login }}:latest \
           ${{ inputs.image_name_github_login }}:${{ github.sha }}
+        docker buildx imagetools create \
+          --tag ${{ inputs.image_name_google_api }}:latest-fips \
+          ${{ inputs.image_name_google_api }}:${{ github.sha }}-fips
+        docker buildx imagetools create \
+          --tag ${{ inputs.image_name_google_api }}:latest-fips-debug \
+          ${{ inputs.image_name_google_api }}:${{ github.sha }}-fips-debug
+        docker buildx imagetools create \
+          --tag ${{ inputs.image_name_google_login }}:latest-fips \
+          ${{ inputs.image_name_google_login }}:${{ github.sha }}-fips
 
   homebrew-tap:
     runs-on: ubuntu-22.04