From 3a27d3754e9a092e556f06794ba5a4338315e8e0 Mon Sep 17 00:00:00 2001 From: Se Yeon Kim <25109943+say-yawn@users.noreply.github.com> Date: Mon, 29 Jun 2026 16:27:24 -0500 Subject: [PATCH 1/6] Update README for makecsr Fix AUT-583 --- tools/makecsr/README.md | 16 ++++++++++++---- 1 file changed, 12 insertions(+), 4 deletions(-) diff --git a/tools/makecsr/README.md b/tools/makecsr/README.md index a79ba8d7c..334fff6ed 100644 --- a/tools/makecsr/README.md +++ b/tools/makecsr/README.md @@ -52,23 +52,29 @@ For more information, see https://mana.mozilla.org/wiki/pages/viewpage.action?pageId=87365053 ### Putting it all together, practical GCP example -1. Have your keys created in GCP KMS and be sure that your user account has the `cloudkms.signerVerifier` role attached. +1. Have your keys created in GCP KMS and be sure that your user account has the `cloudkms.signerVerifier` role attached. If role not attached, follow [example PR in mozilla/webservices-infra](https://github.com/mozilla/webservices-infra/pull/11578) to add role. + +> [!TIP] +> Leave PR open to give role and use the same PR to remove the role once the work is complete. 2. Create a read only libkmsp11-config.yaml file like this ``` tokens: - - key_ring: projects/my-project/locations/global/keyRings/my-key-ring + - key_ring: projects/my-project-id/locations/global/keyRings/my-key-ring label: gcp-token -# Note: This file should be read-only. You can do `chmod -w libkmsp11-config.yaml` after you create it. ``` +> [!Note] +> This file should be read-only because GCP expects the file to be read-only. You can do `chmod -w libkmsp11-config.yaml` after you create it. 3. Create a crypto11-config.json file like this ``` { "Path": "/app/libkmsp11.so", - "TokenLabel": "gcp-autograph-token" + "TokenLabel": "gcp-token" } ``` +> [!IMPORTANT] +> `TokenLabel` in crypto11-config.json and `label` from libkmsp11-config.yaml both need to be same value. 4. Get authenticated with GCP. Ex: `gcloud auth login --update-adc` @@ -84,6 +90,8 @@ docker run -it --rm --user 0:0 \ -v "${PWD}/crypto11-config.json:/mnt/crypto11-config.json" \ "mozilla/autograph:latest" /bin/bash ``` +> [!NOTE] +> If using MacOS, add `--platform=linux/amd64` during `docker run` command. PKCS #11 Library for Cloud KMS, the `libkmsp11.so`, is only available in Windows and AMD64 ([doc](https://github.com/GoogleCloudPlatform/kms-integrations/blob/master/kmsp11/docs/user_guide.md#getting-started)). 7. Run the makecsr command with the options you want. ``` From 03a4d369af981b2baf1f8df98fa5ae3fa37faa17 Mon Sep 17 00:00:00 2001 From: Se Yeon Kim <25109943+say-yawn@users.noreply.github.com> Date: Mon, 29 Jun 2026 16:39:33 -0500 Subject: [PATCH 2/6] Propogate failure to build during different os and architecture Had unhelpful failure while running the `makecsr` command which was hiding an OS issue. Fix AUT-583 --- Dockerfile | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/Dockerfile b/Dockerfile index 56a84422f..6e59f1f52 100644 --- a/Dockerfile +++ b/Dockerfile @@ -36,11 +36,13 @@ RUN apt-get clean && rm -rf /var/lib/apt/lists/* #------------------------------------------------------------------------------ FROM base AS prebuild ARG LIBKMSP11_VERSION +ARG BUILDOS +ARG BUILDARCH COPY google-pkcs12-release-signing-key.pem /app/src/autograph/ # Download and verify the Google KMS library -RUN cd /tmp && curl -L https://github.com/GoogleCloudPlatform/kms-integrations/releases/download/pkcs11-v${LIBKMSP11_VERSION}/libkmsp11-${LIBKMSP11_VERSION}-linux-amd64.tar.gz | tar -zx --strip-components=1 +RUN cd /tmp && curl -L https://github.com/GoogleCloudPlatform/kms-integrations/releases/download/pkcs11-v${LIBKMSP11_VERSION}/libkmsp11-${LIBKMSP11_VERSION}-${BUILDOS}-${BUILDARCH}.tar.gz | tar -zx --strip-components=1 RUN openssl dgst -sha384 -verify /app/src/autograph/google-pkcs12-release-signing-key.pem -signature /tmp/libkmsp11.so.sig /tmp/libkmsp11.so # fetch the RDS CA bundles From e3c65d1d9366f4bb0986abee7b96df6c0aa3539f Mon Sep 17 00:00:00 2001 From: Se Yeon Kim <25109943+say-yawn@users.noreply.github.com> Date: Mon, 29 Jun 2026 16:52:17 -0500 Subject: [PATCH 3/6] Clarify ARM64 requirement Co-authored-by: Alex Cottner <148472676+alexcottner@users.noreply.github.com> --- tools/makecsr/README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tools/makecsr/README.md b/tools/makecsr/README.md index 334fff6ed..58727792b 100644 --- a/tools/makecsr/README.md +++ b/tools/makecsr/README.md @@ -91,7 +91,7 @@ docker run -it --rm --user 0:0 \ "mozilla/autograph:latest" /bin/bash ``` > [!NOTE] -> If using MacOS, add `--platform=linux/amd64` during `docker run` command. PKCS #11 Library for Cloud KMS, the `libkmsp11.so`, is only available in Windows and AMD64 ([doc](https://github.com/GoogleCloudPlatform/kms-integrations/blob/master/kmsp11/docs/user_guide.md#getting-started)). +> If using arm64 (ex: macOS or arm linux) add `--platform=linux/amd64` during `docker run` command. PKCS #11 Library for Cloud KMS, the `libkmsp11.so`, is only available in Windows and AMD64 ([doc](https://github.com/GoogleCloudPlatform/kms-integrations/blob/master/kmsp11/docs/user_guide.md#getting-started)). 7. Run the makecsr command with the options you want. ``` From 0fe0da72d9c9c4483c0018d0676db176a72288c8 Mon Sep 17 00:00:00 2001 From: Se Yeon Kim <25109943+say-yawn@users.noreply.github.com> Date: Wed, 8 Jul 2026 16:17:50 -0500 Subject: [PATCH 4/6] Debug line to check built-in variables Fix AUT-618 --- Dockerfile | 1 + 1 file changed, 1 insertion(+) diff --git a/Dockerfile b/Dockerfile index 6e59f1f52..e5b0d2bf5 100644 --- a/Dockerfile +++ b/Dockerfile @@ -42,6 +42,7 @@ ARG BUILDARCH COPY google-pkcs12-release-signing-key.pem /app/src/autograph/ # Download and verify the Google KMS library +RUN echo "Download Google KMS library for ${BUILDOS} and ${BUILDARCH}." RUN cd /tmp && curl -L https://github.com/GoogleCloudPlatform/kms-integrations/releases/download/pkcs11-v${LIBKMSP11_VERSION}/libkmsp11-${LIBKMSP11_VERSION}-${BUILDOS}-${BUILDARCH}.tar.gz | tar -zx --strip-components=1 RUN openssl dgst -sha384 -verify /app/src/autograph/google-pkcs12-release-signing-key.pem -signature /tmp/libkmsp11.so.sig /tmp/libkmsp11.so From 81d99d6fce89327de3b528cc03864384927750cb Mon Sep 17 00:00:00 2001 From: Se Yeon Kim <25109943+say-yawn@users.noreply.github.com> Date: Wed, 8 Jul 2026 16:41:21 -0500 Subject: [PATCH 5/6] Remove code that disabled Docker's buildkit Fix AUT-618 --- Makefile | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/Makefile b/Makefile index 20cc53e1a..bd1129dda 100644 --- a/Makefile +++ b/Makefile @@ -76,9 +76,9 @@ gpg-test-clean: # app-hsm -> monitor-hsm(app-hsm writes chains and updated config to shared /tmp volume) # build: generate - DOCKER_BUILDKIT=0 COMPOSE_DOCKER_CLI_BUILD=0 docker compose build --parallel app db - DOCKER_BUILDKIT=0 COMPOSE_DOCKER_CLI_BUILD=0 docker compose build --parallel app-hsm monitor - DOCKER_BUILDKIT=0 COMPOSE_DOCKER_CLI_BUILD=0 docker compose build --parallel monitor monitor-hsm + COMPOSE_DOCKER_CLI_BUILD=0 docker compose build --parallel app db + COMPOSE_DOCKER_CLI_BUILD=0 docker compose build --parallel app-hsm monitor + COMPOSE_DOCKER_CLI_BUILD=0 docker compose build --parallel monitor monitor-hsm test-in-docker: build $(SHELL) -c " \ From 7bb1bde6210519a148acb273578227906237ce65 Mon Sep 17 00:00:00 2001 From: Se Yeon Kim <25109943+say-yawn@users.noreply.github.com> Date: Fri, 10 Jul 2026 14:17:49 -0500 Subject: [PATCH 6/6] Use target instead of build os and arch Recommended from cross-compile documentation: https://docs.docker.com/build/building/multi-platform/#cross-compiling-a-go-application AUT-618 --- Dockerfile | 8 ++++---- docker-compose.yml | 2 ++ 2 files changed, 6 insertions(+), 4 deletions(-) diff --git a/Dockerfile b/Dockerfile index e5b0d2bf5..56f92398d 100644 --- a/Dockerfile +++ b/Dockerfile @@ -36,14 +36,14 @@ RUN apt-get clean && rm -rf /var/lib/apt/lists/* #------------------------------------------------------------------------------ FROM base AS prebuild ARG LIBKMSP11_VERSION -ARG BUILDOS -ARG BUILDARCH +ARG TARGETOS +ARG TARGETARCH COPY google-pkcs12-release-signing-key.pem /app/src/autograph/ # Download and verify the Google KMS library -RUN echo "Download Google KMS library for ${BUILDOS} and ${BUILDARCH}." -RUN cd /tmp && curl -L https://github.com/GoogleCloudPlatform/kms-integrations/releases/download/pkcs11-v${LIBKMSP11_VERSION}/libkmsp11-${LIBKMSP11_VERSION}-${BUILDOS}-${BUILDARCH}.tar.gz | tar -zx --strip-components=1 +RUN echo "Download Google KMS library for ${TARGETOS} and ${TARGETARCH}." +RUN cd /tmp && curl -L https://github.com/GoogleCloudPlatform/kms-integrations/releases/download/pkcs11-v${LIBKMSP11_VERSION}/libkmsp11-${LIBKMSP11_VERSION}-${TARGETOS}-${TARGETARCH}.tar.gz | tar -zx --strip-components=1 RUN openssl dgst -sha384 -verify /app/src/autograph/google-pkcs12-release-signing-key.pem -signature /tmp/libkmsp11.so.sig /tmp/libkmsp11.so # fetch the RDS CA bundles diff --git a/docker-compose.yml b/docker-compose.yml index 176a16d9a..d40210add 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -21,6 +21,8 @@ services: image: autograph-app build: context: . + platforms: + - "linux/amd64" environment: - AUTOGRAPH_DB_DSN=host=db user=myautographdbuser dbname=autograph password=myautographdbpassword sslmode=verify-full sslrootcert=/opt/db-root.crt links: