Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

enabled CGO for Macos otelcol contrib #626

Open
wants to merge 18 commits into
base: main
Choose a base branch
from

Conversation

pureklkl
Copy link

@pureklkl pureklkl commented Aug 2, 2024

Add a CGO enabled otelcol-contrib for macos
open-telemetry/opentelemetry-collector-contrib#33393

There are some test failures need be fixed by this PR
open-telemetry/opentelemetry-collector-contrib#33921

@pureklkl pureklkl requested review from a team and TylerHelmuth August 2, 2024 20:21
@atoulme
Copy link
Contributor

atoulme commented Aug 2, 2024

Nice work :)

Copy link
Member

@jpkrohling jpkrohling left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can you please go over our security audit? it lists a few recommendations in case we ever change to CGO, which this PR is doing.

https://7asecurity.com/reports/pentest-report-opentelemetry.pdf

@jpkrohling
Copy link
Member

Related: #618

@pureklkl
Copy link
Author

The checksec.sh is not working for macos ref
I used snake&apple instead, see section3. But this is also not accurate because it is for Xcode compiled binary instead of golang. Here is the result

PIE: True
ARC: False
STRIPPED: False
CANARY: True
NX STACK: True
NX HEAP: False
XN: True
NOTARIZED: False
ENCRYPTED: False
RESTRICTED: False
HARDENED: False
APP SANDBOX: False
FORTIFIED: True
RPATH: False

I am not a security expert, so need advice other tools that can check macos binary security.

.github/workflows/release-contrib-cgo.yaml Outdated Show resolved Hide resolved
@@ -0,0 +1,11 @@
# OpenTelemetry Collector Contrib CGO Distro
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

As a user, I would find it confusing. Why should I care? What does it bring that others don't?

I'm not sure I like the idea of a distribution with just a different platform or compilation mechanism. I would prefer a solution where we built with the right options based on what we need to ship.

Does hostmetrics require cgo when compiled for Darwin? Then we should use cgo to compile the distributions that include that component for Darwin.

I find a separate cgo distribution confusing, and opens the door for a cgo distribution for other platforms, which is not something we want.

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

My concern is that when CGO is enabled, the binary is coupled to certain OS versions and will support less OS versions.

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@jpkrohling
Hi, I have updated the PR to just enable CGO for Macos otelcol contrib, could you review it again?

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I would like to have it discussed as part of the SIG and have buy-in from other maintainers.

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hi, I have tested with golang 10.15 and it works, which is also the oldest macos version that golang >= 1.21 supported ref
I think we could just turn on the CGO option without a separated distribution.

@pureklkl pureklkl requested a review from jpkrohling August 19, 2024 23:13
@pureklkl pureklkl changed the title Macos CGO enabled distribution enabled CGO for Macos otelcol contrib Aug 23, 2024
.github/workflows/base-release.yaml Outdated Show resolved Hide resolved
@pureklkl
Copy link
Author

configure.go need to be modified to fix the build, and it will be affected by whether we want a new distribution. I will fix the build once the community have a decision.

@pureklkl pureklkl requested a review from a team as a code owner September 25, 2024 00:01
@pureklkl pureklkl requested a review from jpkrohling September 27, 2024 20:50
func Archive(dist string) config.Archive {
func Archive(dist string, cgo string) config.Archive {
builds := []string{dist}
if len(cgo) > 0 {
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

what's the benefit of having cgo set as a string instead of a bool? Do we plan to have more conditional logic based on the content of cgo if we have more distributions built with cgo in the future?

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I put it to string in case we need other OS to support cgo in the future. I also wrote it in the cgoFlag description.

@jackgopack4
Copy link
Contributor

have you made a modified fork of this pr with references to repos changed to your fork, and run a release in your fork?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants