# Build toolchain for the FIPS test/dev image. # # This layer is expensive (~15 min from scratch: two OpenSSL builds, SoftHSM2, Oracle # Instant Client) and changes very rarely, so it is published to GHCR by # .github/workflows/publish-fips-toolchain.yml and consumed by Dockerfile.dev.fips. # # Anything edited here changes the published tag, so CI will rebuild it from source on # the PR that changes it and publish the new tag once that PR lands on main. # # SCOPE: this is an internal CI build cache, not a supported Infisical artifact. It is # published publicly only so CI and local dev can pull it instead of recompiling. It is # not part of any public API, carries no support or compatibility guarantee, and its tags # may change or be deleted at any time. It is NOT the FIPS product image. That one is # infisical/infisical-fips, built from Dockerfile.fips.standalone-infisical. # # THIRD-PARTY CONTENTS: includes Oracle Instant Client, redistributed under the Oracle # Free Distribution, Hosting, and Use Terms and Conditions, which permit redistribution # of the unmodified Program provided a copy of the license accompanies it. That copy # ships in the image at /opt/oracle/instantclient_23_26/BASIC_LICENSE and must not be # removed. Also includes OpenSSL (Apache-2.0), SoftHSM2 (BSD-2-Clause), the Infisical # CLI, and Debian packages under their respective licenses. ARG INFISICAL_CLI_VERSION=0.45.4 FROM debian:trixie-slim AS oracle RUN apt-get update && apt-get install -y unzip wget ca-certificates \ && rm -rf /var/lib/apt/lists/* # Own stage so the 127 MB fetch caches independently and runs in parallel. Better # still would be mirroring the zip on artifacts-cli.infisical.com, which drops the # third-party CDN dependency instead of retrying around it. RUN ARCH=$(dpkg --print-architecture) && \ if [ "$ARCH" = "amd64" ]; then \ ORACLE_ZIP="instantclient-basic-linux.x64-23.26.0.0.0.zip" && \ EXPECTED_SHA="d6c79cbcf0ff209363e779855c690d4fc730aed847e9198a2c439bcf34760af5"; \ elif [ "$ARCH" = "arm64" ]; then \ ORACLE_ZIP="instantclient-basic-linux.arm64-23.26.0.0.0.zip" && \ EXPECTED_SHA="9c9a32051e97f087016fb334b7ad5c0aea8511ca8363afd8e0dc6ec4fc515c32"; \ else \ echo "Unsupported architecture: $ARCH" >&2 && exit 1; \ fi && \ ORACLE_URL="https://download.oracle.com/otn_software/linux/instantclient/2326000/${ORACLE_ZIP}" && \ wget -q "$ORACLE_URL" && \ echo "$EXPECTED_SHA $ORACLE_ZIP" | sha256sum -c - && \ mkdir -p /opt/oracle && \ unzip "$ORACLE_ZIP" -d /opt/oracle && \ rm "$ORACLE_ZIP" FROM node:26.12.1-trixie-slim ARG SOFTHSM2_VERSION=2.5.0 ARG SOFTHSM2_COMMIT=369df0383d101bc8952692c2a368ac8bc887d1b4 ENV SOFTHSM2_VERSION=${SOFTHSM2_VERSION} \ SOFTHSM2_SOURCES=/tmp/softhsm2 ARG INFISICAL_CLI_VERSION RUN apt-get update && apt-get install -y \ build-essential \ autoconf \ automake \ git \ libtool \ libssl-dev \ python3 \ make \ g++ \ openssh-client \ curl \ pkg-config \ perl \ wget \ libaio1t64 \ unixodbc \ unixodbc-dev \ freetds-dev \ freetds-bin \ tdsodbc \ opensc \ smbclient \ && curl -1sLf 'https://artifacts-cli.infisical.com/setup.deb.sh' | bash \ && test -n "$INFISICAL_CLI_VERSION" \ && apt-get update && apt-get install -y infisical="$INFISICAL_CLI_VERSION" \ && rm -rf /var/lib/apt/lists/* RUN ARCH=$(dpkg --print-architecture) && \ if [ "$ARCH" = "arm64" ]; then \ ln -sf /lib/aarch64-linux-gnu/libaio.so.1t64 /lib/aarch64-linux-gnu/libaio.so.1; \ fi RUN printf "[FreeTDS]\nDescription = FreeTDS Driver\nDriver = /usr/lib/x86_64-linux-gnu/odbc/libtdsodbc.so\nSetup = /usr/lib/x86_64-linux-gnu/odbc/libtdsodbc.so\nFileUsage = 1\n" > /etc/odbcinst.ini RUN git clone https://github.com/opendnssec/SoftHSMv2.git ${SOFTHSM2_SOURCES} WORKDIR ${SOFTHSM2_SOURCES} RUN git checkout --detach "${SOFTHSM2_COMMIT}" \ && test "$(git rev-parse HEAD)" = "${SOFTHSM2_COMMIT}" \ && sh autogen.sh \ && ./configure --prefix=/usr/local --disable-gost \ && make \ && make install WORKDIR /root RUN rm -fr ${SOFTHSM2_SOURCES} # Oracle Instant Client for OracleDB mTLS (Wallet) support COPY --from=oracle /opt/oracle /opt/oracle RUN echo /opt/oracle/instantclient_23_26 > /etc/ld.so.conf.d/oracle-instantclient.conf && ldconfig WORKDIR /openssl-build RUN wget https://www.openssl.org/source/openssl-3.1.2.tar.gz \ && echo "a0ce69b8b97ea6a35b96875235aa453b966ba3cba8af2de23657d8b6767d6539 openssl-3.1.2.tar.gz" | sha256sum -c - \ && tar -xf openssl-3.1.2.tar.gz \ && cd openssl-3.1.2 \ && ./Configure enable-fips --libdir=lib \ && make -j"$(nproc)" \ && make install_fips \ && test -f /usr/local/lib/ossl-modules/fips.so \ && cd / \ && rm -rf /openssl-build \ && apt-get clean \ && rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/* WORKDIR /tmp/openssl-pqc-build RUN wget -q https://github.com/openssl/openssl/releases/download/openssl-3.5.9/openssl-3.5.9.tar.gz \ && echo "603f5602e2eef00d77fbd429d34dcd5822bb301757a1bc9cdb24c670f1eb859a openssl-3.5.9.tar.gz" | sha256sum -c - \ && tar -xf openssl-3.5.9.tar.gz \ && cd openssl-3.5.9 \ && ./Configure --prefix=/opt/openssl-pqc --openssldir=/opt/openssl-pqc/ssl no-docs \ && make -j"$(nproc)" \ && make install_sw \ && cd / \ && rm -rf /tmp/openssl-pqc-build WORKDIR /app LABEL org.opencontainers.image.title="Infisical backend FIPS test toolchain" \ org.opencontainers.image.description="Internal CI build cache for Infisical's backend FIPS test image (Dockerfile.dev.fips). Not a supported or versioned public artifact: no support or compatibility guarantee, tags may change or be deleted without notice, and it is not the FIPS product image (that is infisical/infisical-fips). Do not depend on it outside Infisical CI and local development." \ org.opencontainers.image.source="https://github.com/Infisical/infisical" \ org.opencontainers.image.licenses="NOASSERTION" \ com.infisical.image.internal="true" \ com.infisical.image.supported="false" \ com.infisical.thirdparty.oracle-instantclient.license="/opt/oracle/instantclient_23_26/BASIC_LICENSE"