Cross-compilation problems

[DDzwiedziu]

Edit: on hold, as I was trying to compile on an unclean tree from HEAD.
Nope, checking out v0.28.1 and make clean did not help.

As my Raspberry Pi 3 cannot handle compiling step-ca and prebuilt packages aren't compiled with Yubikey support for some reason (see also my other discussion [1]), I'm trying to cross-compile.

…with measly results, even after fiddling with Go versions, compile environmental variables:

❯ make build GOFLAGS=""
runtime/cgo
# runtime/cgo
gcc_libinit.c: In function ‘_cgo_set_stacklo’:
gcc_libinit.c:111:81: error: cast to pointer from integer of different size [-Werror=int-to-pointer-cast]
  111 |                 fprintf(stderr, "runtime/cgo: bad stack bounds: lo=%p hi=%p\n", (void*)(g->stacklo), (void*)(g->stackhi));
      |                                                                                 ^
gcc_libinit.c:111:102: error: cast to pointer from integer of different size [-Werror=int-to-pointer-cast]
  111 |                 fprintf(stderr, "runtime/cgo: bad stack bounds: lo=%p hi=%p\n", (void*)(g->stacklo), (void*)(g->stackhi));
      |                                                                                                      ^
cc1: all warnings being treated as errors
make: *** [Makefile:90: bin/step-ca] Error 1

[1] #2087

[hslatman]

Before diving deeper into cross-compilation: what error do you get when compiling on the Raspberry Pi 3 itself? I think it should be capable of compiling using CGO_ENABLED=1 and the appropriate libraries being available.

[DDzwiedziu]

That isn't the fault of your software. As the RPi3 just hangs, probably due to IO wait (edit: or overheating). I'm running a µSD card for a few years, with/after different experiments, so it might just be too worn out.

This is what I was trying just before this post, with the last messages.

export GOMAXPROCS=1; (time (nice -n15 unbuffer make -j1 bootstrap && nice -n15 unbuffer make -j1 build GOFLAGS="")) | tee $(date -Is)-$(basename $(dirname $(pwd)/.))-go-compile.log
golangci/golangci-lint info checking GitHub for tag 'latest'
golangci/golangci-lint info found version: 1.62.2 for v1.62.2/linux/arm64
golangci/golangci-lint info installed /home/dietpi/go/bin/golangci-lint

I'm trying now to move the ~/go directory to a USB pendrive. If that doesn't help I will add ionice to that one-liner.

[DDzwiedziu]

How can I check what features were compiled in?
Just trying strings gets me the below, which would suggest that YK support is compiled in and it isn't.

❯ strings ./bin/step-ca | egrep -i 'yubikey'
[value]stepcassoftcashttp-01unknowncontexttokenIDpidfileonboardAddressversionca.jsonContextPrintlnOPTIONS<[^>]*>DES-CBCssh-rsaawskms:RSA-HSMEd25519softkmsyubikeydefaultforcegcallocmWcpuprofallocmRgctraceIO waitrunningsyscallwaitingforevernetworkUNKNOWN:events, goid= s=nil
 (scan  MB in pacer: % CPU ( zombie, j0 = head = ,errno=panic:  nmsys= locks= dying= allocsrax    rbx    rcx    rdx    rdi    rsi    rbp    rsp    r8     r9     r10    r11    r12    r13    r14    r15    rip    rflags cs     fs     gs     Signal signal  m->g0= pad1=  pad2=  text= minpc=        value= (scan)   types : type nil keytls3desderivedInitialExpiresSubject%03d %srecvmsgsendmsgconnectlookup writetocharsetAvestanBengaliBrailleCypriotDeseretElbasanElymaicGranthaHanunooKannadaMakasarMandaicMarchenMultaniMyanmarOsmanyaSharadaShavianSiddhamSinhalaSogdianSoyomboTagalogTibetanTirhutaabortedstoppedaccept4Floats:InstAltInstNopalt -> nop -> any -> %s %10d%v %v @samplesprintlndeletednebula/webhooksshpop/DEFAULTSOFTCASSTEPCASSNIPPETREVOKEDHTTP_01NO_KINDSOFTKMSYUBIKEYSHA-224SHA-256SHA-384SHA-512MD5-RSAserial:arcfourssh-dssSHA256:sshtypeRenewalsnippetA256GCMECDH-ESnumber createdservingMD2-RSA2.5.4.62.5.4.32.5.4.52.5.4.72.5.4.82.5.4.9crlSignasn1Encasn1Seqasn1SetED25519%s (%s)pendingpubAreaaccount/healthBearer /revokesecretsmap keymagentabgBlackbgGreenbgWhite  {{.}}Headingaddressarticlesectionmailto:title="id="%s"<html>
 executable command must be providedWARNING: %T does not implement request.Retryer; using DefaultRetryer insteadinvalid Body.Read call. After hijacked, the original Request must not be used<html><head><title>Timeout</title></head><body><h1>Timeout</h1></body></html>MapIter.Next called on an iterator that does not have an associated map Value^[a-fA-F0-9]{8}-[a-fA-F0-9]{4}-[a-fA-F0-9]{4}-[a-fA-F0-9]{4}-[a-fA-F0-9]{12}$failed creating attestation client: attestation CA base URL must not be emptyunsupported kms type 'yubikey': %s is compiled without cgo or YubiKey supportcrypto/tls: ExportKeyingMaterial is unavailable when renegotiation is enabledinvalid function signature for %s: second return value should be error; is %shttp://metadata/computeMetadata/v1/instance/service-accounts/default/identitycertificate request does not contain the valid IP addresses - got %v, want %vgrpc: credentials.Bundle may not be used with individual TransportCredentialsClientConn's authority from transport creds %q and dial option %q don't matcherror parsing HardwareModuleName SAN: empty value or asn1Value is not allowedReload failed because the CA with new configuration could not be initialized.profile %q is configured to use SSO but is missing required configuration: %sINSERT INTO `%s`(nkey, nvalue) VALUES(?,?) ON DUPLICATE KEY UPDATE nvalue = ?go-jose/go-jose/jwt: expected claims to be value convertible into JSON objectonly data and encryptedData content types are supported in authenticated safeCannot use NewTransactionAt with managedDB=false. Use NewTransaction instead.number of field descriptions must equal number of destinations, got %d and %dcollected metric named %q collides with previously collected summary named %qoauth2/google/externalaccount: got invalid expiry from security token serviceexpected AuthenticationGSSContinue message but received unexpected message %Toauth2/google: failed to unmarshal response body from Secure Token Server: %vassume role with MFA enabled, but neither TokenCode nor TokenProvider are setpattern %q (registered at %s) conflicts with pattern %q (registered at %s):
go.step.sm/crypto/kms/yubikey.init.0
go.step.sm/crypto/kms/yubikey.init.0.func1
/home/dzwiedziu/go/pkg/mod/go.step.sm/crypto@v0.54.2/kms/yubikey/yubikey_no_cgo.go
YUBIKEY
go.step.sm/crypto/kms/yubikey.init.0
go.step.sm/crypto/kms/yubikey.init.0.func1
go.step.sm/crypto/kms/yubikey..inittask

Edit: is there a mistake in the step-ca on RPi tutorial?

The build documents read:

The CGO build enables PKCS #11 and YubiKey PIV support
(…)
2. Build step-ca

To build step-ca, clone this repository and run the following:

make bootstrap && make build GO_ENVS="CGO_ENABLED=1"

While the tutorial reads:

$ make bootstrap
$ make build GOFLAGS=""

Edit 2: compiling with GO_ENVS="CGO_ENABLED=1" did not help.

[hslatman]

The yubikey KMS is not a specific module, so it's not as simple as checking the compiled in modules to see if support is enabled or not. It's possible there's a mismatch between the tutorial and the Makefile, because it's been a while since the tutorial was created.

The output you're seeing looks like the case in which YubiKey support is disabled, which is the case when CGO is disabled, or YubiKey specifically is disabled. Using strings you should see output like go.step.sm/crypto/kms/yubikey.(*YubiKey).LoadCertificate when checking strings step-ca | grep -i yubikey.

What happens with CGO_ENABLED=1 go build -o step-ca cmd/step-ca/main.go and then checking the new step-ca binary? This should be the most compact way for getting a build with YubiKey support baked in (when compiled on your Pi).

[DDzwiedziu]

This is the output of strings step-ca | grep -i yubikey | tee $(date -Is)-$(basename $(dirname $(pwd)/.)).strings.log on the build machine.
2024-12-09T13:35:05+01:00-step-ca.strings.log

When I've came back a few days later I've discovered that there is a different step-ca in the base build directory, different in the bin directory and make install via checkinstall gives a third binary, which checksum matches the one that doesn't have YK build in on the VM.

❯ sha256sum step-ca ./bin/step-ca usr/local/bin/step-ca | egrep -i 'a4fddf475a2adfa41289049fd1ece9e7e933187c95ee447060207e5bb6c5744d|'
323afc755f340b13ae5a03e8b99921dfcf04a9a8ae6f130881b38eec504d17ed  step-ca
05d02513df91dbaa0f73b3eea0fa5b800cc1c87298b23e601f9ce6526ff9af20  ./bin/step-ca
a4fddf475a2adfa41289049fd1ece9e7e933187c95ee447060207e5bb6c5744d  usr/local/bin/step-ca

And I'm stumped, as I didn't ever have such issues with checkinstall.

Edit: something doesn't sit right with me. I thought I made a mistake and built without CGO_ENABLED.
(a4fddf475a2adfa41289049fd1ece9e7e933187c95ee447060207e5bb6c5744d is the checksum of step-ca taken from the target VM, where it was installed by a package created by checkinstall)

❯ make clean && make build && make INSTALL_PREFIX=. install && sha256sum step-ca ./bin/step-ca usr/local/bin/step-ca | egrep -i 'a4fddf475a2adfa41289049fd1ece9e7e933187c95ee447060207e5bb6c5744d|'
github.com/smallstep/certificates/cmd/step-ca
Build Complete!
323afc755f340b13ae5a03e8b99921dfcf04a9a8ae6f130881b38eec504d17ed  step-ca
0601641bf20e77ff946a0ba42af853a9c6fc490b012e89e92d29faa8c7da1ae6  ./bin/step-ca
25c7ce2a3dc49dedecf47c3e876485e620e92e503e46d7711af6a90d2c14e77d  usr/local/bin/step-ca

Yet, when I corrected my mistake I saw this:

❯ make clean && make build GO_ENVS="CGO_ENABLED=1" && make INSTALL_PREFIX=. install && sha256sum step-ca ./bin/step-ca usr/local/bin/step-ca | egrep -i 'a4fddf475a2adfa41289049fd1ece9e7e933187c95ee447060207e5bb6c5744d|'
github.com/smallstep/certificates/cmd/step-ca
Build Complete!
github.com/smallstep/certificates/cmd/step-ca
323afc755f340b13ae5a03e8b99921dfcf04a9a8ae6f130881b38eec504d17ed  step-ca
d8af698a5f86767b784b0ba0bc63b12869ea94997116de621f9291ba68b8c1c9  ./bin/step-ca
25c7ce2a3dc49dedecf47c3e876485e620e92e503e46d7711af6a90d2c14e77d  usr/local/bin/step-ca

In summary:

• ./step-ca is the same with and without CGO enabled,
• ./bin/step-ca is the one I should focus on,
• make install creates a completely different package now,
• make install itself outputs the string github.com/smallstep/certificates/cmd/step-ca, which suggests that it downloads the package.

Edit 2:
Does really make install download a ready package, instead of using the already built one‽‽‽

❯ firejail --net=none make INSTALL_PREFIX=. install
cmd/step-ca/main.go:4:2: package flag is not in std (/usr/lib/go-1.23/src/flag)
cmd/step-ca/main.go:5:2: package fmt is not in std (/usr/lib/go-1.23/src/fmt)
authority/authority.go:4:2: package bytes is not in std (/usr/lib/go-1.23/src/bytes)
authority/admins.go:4:2: package context is not in std (/usr/lib/go-1.23/src/context)
authority/authority.go:6:2: package crypto is not in std (/usr/lib/go-1.23/src/crypto)
authority/ssh.go:5:2: package crypto/rand is not in std (/usr/lib/go-1.23/src/crypto/rand)
authority/authority.go:7:2: package crypto/rsa is not in std (/usr/lib/go-1.23/src/crypto/rsa)
authority/authority.go:8:2: package crypto/sha256 is not in std (/usr/lib/go-1.23/src/crypto/sha256)
authority/http_client.go:4:2: package crypto/tls is not in std (/usr/lib/go-1.23/src/crypto/tls)
authority/authority.go:9:2: package crypto/x509 is not in std (/usr/lib/go-1.23/src/crypto/x509)
authority/tls.go:8:2: package crypto/x509/pkix is not in std (/usr/lib/go-1.23/src/crypto/x509/pkix)
authority/tls.go:9:2: package encoding/asn1 is not in std (/usr/lib/go-1.23/src/encoding/asn1)
authority/tls.go:10:2: package encoding/base64 is not in std (/usr/lib/go-1.23/src/encoding/base64)
authority/ssh.go:7:2: package encoding/binary is not in std (/usr/lib/go-1.23/src/encoding/binary)
authority/authority.go:10:2: package encoding/hex is not in std (/usr/lib/go-1.23/src/encoding/hex)
authority/export.go:4:2: package encoding/json is not in std (/usr/lib/go-1.23/src/encoding/json)
authority/linkedca.go:10:2: package encoding/pem is not in std (/usr/lib/go-1.23/src/encoding/pem)
authority/policy.go:5:2: package errors is not in std (/usr/lib/go-1.23/src/errors)
../../../go/pkg/mod/github.com/pkg/errors@v0.9.1/errors.go:97:2: package io is not in std (/usr/lib/go-1.23/src/io)
../../../go/pkg/mod/github.com/pkg/errors@v0.9.1/stack.go:6:2: package path is not in std (/usr/lib/go-1.23/src/path)
../../../go/pkg/mod/github.com/pkg/errors@v0.9.1/stack.go:7:2: package runtime is not in std (/usr/lib/go-1.23/src/runtime)
../../../go/pkg/mod/github.com/pkg/errors@v0.9.1/stack.go:8:2: package strconv is not in std (/usr/lib/go-1.23/src/strconv)
../../../go/pkg/mod/github.com/pkg/errors@v0.9.1/stack.go:9:2: package strings is not in std (/usr/lib/go-1.23/src/strings)
api/log/log.go:7:2: package net/http is not in std (/usr/lib/go-1.23/src/net/http)
api/log/log.go:8:2: package os is not in std (/usr/lib/go-1.23/src/os)
../../../go/pkg/mod/google.golang.org/protobuf@v1.35.2/internal/detrand/rand.go:14:2: package hash/fnv is not in std (/usr/lib/go-1.23/src/hash/fnv)
../../../go/pkg/mod/google.golang.org/protobuf@v1.35.2/encoding/protowire/wire.go:14:2: package math is not in std (/usr/lib/go-1.23/src/math)
../../../go/pkg/mod/google.golang.org/protobuf@v1.35.2/encoding/protowire/wire.go:15:2: package math/bits is not in std (/usr/lib/go-1.23/src/math/bits)
../../../go/pkg/mod/google.golang.org/protobuf@v1.35.2/internal/strs/strings.go:9:2: package go/token is not in std (/usr/lib/go-1.23/src/go/token)
../../../go/pkg/mod/google.golang.org/protobuf@v1.35.2/internal/pragma/pragma.go:9:8: package sync is not in std (/usr/lib/go-1.23/src/sync)
../../../go/pkg/mod/google.golang.org/protobuf@v1.35.2/reflect/protoreflect/value_equal.go:11:2: package reflect is not in std (/usr/lib/go-1.23/src/reflect)
../../../go/pkg/mod/google.golang.org/protobuf@v1.35.2/reflect/protoreflect/value_unsafe_go121.go:10:2: package unsafe is not in std (/usr/lib/go-1.23/src/unsafe)
../../../go/pkg/mod/google.golang.org/protobuf@v1.35.2/internal/strs/strings.go:11:2: package unicode is not in std (/usr/lib/go-1.23/src/unicode)
../../../go/pkg/mod/google.golang.org/protobuf@v1.35.2/internal/strs/strings.go:12:2: package unicode/utf8 is not in std (/usr/lib/go-1.23/src/unicode/utf8)
../../../go/pkg/mod/google.golang.org/protobuf@v1.35.2/internal/encoding/json/decode.go:11:2: package regexp is not in std (/usr/lib/go-1.23/src/regexp)
../../../go/pkg/mod/google.golang.org/protobuf@v1.35.2/internal/encoding/json/decode_string.go:10:2: package unicode/utf16 is not in std (/usr/lib/go-1.23/src/unicode/utf16)
../../../go/pkg/mod/google.golang.org/protobuf@v1.35.2/internal/editiondefaults/defaults.go:9:8: package embed is not in std (/usr/lib/go-1.23/src/embed)
../../../go/pkg/mod/google.golang.org/protobuf@v1.35.2/internal/order/range.go:9:2: package sort is not in std (/usr/lib/go-1.23/src/sort)
../../../go/pkg/mod/google.golang.org/protobuf@v1.35.2/internal/filedesc/desc.go:12:2: package sync/atomic is not in std (/usr/lib/go-1.23/src/sync/atomic)
../../../go/pkg/mod/google.golang.org/protobuf@v1.35.2/encoding/protojson/well_known_types.go:13:2: package time is not in std (/usr/lib/go-1.23/src/time)
../../../go/pkg/mod/google.golang.org/grpc@v1.67.1/rpc_util.go:22:2: package compress/gzip is not in std (/usr/lib/go-1.23/src/compress/gzip)
../../../go/pkg/mod/golang.org/x/net@v0.31.0/internal/timeseries/timeseries.go:10:2: package log is not in std (/usr/lib/go-1.23/src/log)
../../../go/pkg/mod/golang.org/x/net@v0.31.0/trace/events.go:10:2: package html/template is not in std (/usr/lib/go-1.23/src/html/template)
../../../go/pkg/mod/golang.org/x/net@v0.31.0/trace/trace.go:72:2: package net is not in std (/usr/lib/go-1.23/src/net)
../../../go/pkg/mod/golang.org/x/net@v0.31.0/trace/trace.go:74:2: package net/url is not in std (/usr/lib/go-1.23/src/net/url)
../../../go/pkg/mod/golang.org/x/net@v0.31.0/trace/events.go:20:2: package text/tabwriter is not in std (/usr/lib/go-1.23/src/text/tabwriter)
../../../go/pkg/mod/golang.org/x/sys@v0.27.0/unix/aliases.go:9:8: package syscall is not in std (/usr/lib/go-1.23/src/syscall)
../../../go/pkg/mod/google.golang.org/grpc@v1.67.1/experimental/stats/metricregistry.go:22:2: package maps is not in std (/usr/lib/go-1.23/src/maps)
../../../go/pkg/mod/google.golang.org/protobuf@v1.35.2/internal/impl/legacy_export.go:10:2: package hash/crc32 is not in std (/usr/lib/go-1.23/src/hash/crc32)
../../../go/pkg/mod/google.golang.org/grpc@v1.67.1/balancer/pickfirst/pickfirst.go:26:2: package math/rand is not in std (/usr/lib/go-1.23/src/math/rand)
../../../go/pkg/mod/google.golang.org/grpc@v1.67.1/internal/binarylog/sink.go:22:2: package bufio is not in std (/usr/lib/go-1.23/src/bufio)
../../../go/pkg/mod/golang.org/x/text@v0.20.0/unicode/bidi/bracket.go:8:2: package container/list is not in std (/usr/lib/go-1.23/src/container/list)
../../../go/pkg/mod/golang.org/x/net@v0.31.0/http/httpguts/guts.go:13:2: package net/textproto is not in std (/usr/lib/go-1.23/src/net/textproto)
../../../go/pkg/mod/golang.org/x/net@v0.31.0/http2/transport.go:19:2: package io/fs is not in std (/usr/lib/go-1.23/src/io/fs)
../../../go/pkg/mod/golang.org/x/net@v0.31.0/http2/transport.go:26:2: package net/http/httptrace is not in std (/usr/lib/go-1.23/src/net/http/httptrace)
../../../go/pkg/mod/google.golang.org/grpc@v1.67.1/internal/transport/proxy.go:29:2: package net/http/httputil is not in std (/usr/lib/go-1.23/src/net/http/httputil)
../../../go/pkg/mod/google.golang.org/grpc@v1.67.1/internal/transport/http2_client.go:28:2: package path/filepath is not in std (/usr/lib/go-1.23/src/path/filepath)
../../../go/pkg/mod/google.golang.org/grpc@v1.67.1/clientconn.go:27:2: package slices is not in std (/usr/lib/go-1.23/src/slices)
../../../go/pkg/mod/github.com/dgraph-io/badger@v1.6.2/db.go:23:2: package expvar is not in std (/usr/lib/go-1.23/src/expvar)
../../../go/pkg/mod/github.com/golang/protobuf@v1.5.4/proto/text_decode.go:8:2: package encoding is not in std (/usr/lib/go-1.23/src/encoding)
../../../go/pkg/mod/github.com/golang/protobuf@v1.5.4/proto/registry.go:11:2: package io/ioutil is not in std (/usr/lib/go-1.23/src/io/ioutil)
../../../go/pkg/mod/github.com/dgraph-io/badger@v1.6.2/y/watermark.go:20:2: package container/heap is not in std (/usr/lib/go-1.23/src/container/heap)
../../../go/pkg/mod/github.com/dustin/go-humanize@v1.0.1/big.go:4:2: package math/big is not in std (/usr/lib/go-1.23/src/math/big)
../../../go/pkg/mod/github.com/golang/glog@v1.2.2/glog_file_nonwindows.go:5:8: package os/user is not in std (/usr/lib/go-1.23/src/os/user)
../../../go/pkg/mod/github.com/golang/glog@v1.2.2/glog.go:110:2: package runtime/pprof is not in std (/usr/lib/go-1.23/src/runtime/pprof)
../../../go/pkg/mod/github.com/smallstep/nosql@v0.7.0/database/database.go:4:2: package database/sql is not in std (/usr/lib/go-1.23/src/database/sql)
../../../go/pkg/mod/github.com/dgraph-io/badger/v2@v2.2007.4/key_registry.go:21:2: package crypto/aes is not in std (/usr/lib/go-1.23/src/crypto/aes)
../../../go/pkg/mod/github.com/dgraph-io/badger/v2@v2.2007.4/y/encrypt.go:21:2: package crypto/cipher is not in std (/usr/lib/go-1.23/src/crypto/cipher)
../../../go/pkg/mod/github.com/cespare/xxhash@v1.1.0/xxhash.go:7:2: package hash is not in std (/usr/lib/go-1.23/src/hash)
../../../go/pkg/mod/github.com/klauspost/compress@v1.17.9/zstd/encoder.go:12:2: package runtime/debug is not in std (/usr/lib/go-1.23/src/runtime/debug)
../../../go/pkg/mod/github.com/go-sql-driver/mysql@v1.8.1/auth.go:14:2: package crypto/sha1 is not in std (/usr/lib/go-1.23/src/crypto/sha1)
../../../go/pkg/mod/github.com/go-sql-driver/mysql@v1.8.1/auth.go:16:2: package crypto/sha512 is not in std (/usr/lib/go-1.23/src/crypto/sha512)
../../../go/pkg/mod/github.com/go-sql-driver/mysql@v1.8.1/connection.go:14:2: package database/sql/driver is not in std (/usr/lib/go-1.23/src/database/sql/driver)
../../../go/pkg/mod/filippo.io/edwards25519@v1.1.0/tables.go:8:2: package crypto/subtle is not in std (/usr/lib/go-1.23/src/crypto/subtle)
../../../go/pkg/mod/github.com/jackc/pgx/v5@v5.6.0/pgconn/auth_scram.go:17:2: package crypto/hmac is not in std (/usr/lib/go-1.23/src/crypto/hmac)
../../../go/pkg/mod/github.com/jackc/pgx/v5@v5.6.0/pgconn/pgconn.go:5:2: package crypto/md5 is not in std (/usr/lib/go-1.23/src/crypto/md5)
../../../go/pkg/mod/github.com/jackc/pgx/v5@v5.6.0/pgtype/builtin_wrappers.go:9:2: package net/netip is not in std (/usr/lib/go-1.23/src/net/netip)
authority/provisioner/nebula.go:5:2: package crypto/ecdh is not in std (/usr/lib/go-1.23/src/crypto/ecdh)
authority/provisioner/k8sSA.go:5:2: package crypto/ecdsa is not in std (/usr/lib/go-1.23/src/crypto/ecdsa)
authority/provisioner/k8sSA.go:6:2: package crypto/ed25519 is not in std (/usr/lib/go-1.23/src/crypto/ed25519)
authority/provisioner/nebula.go:8:2: package crypto/elliptic is not in std (/usr/lib/go-1.23/src/crypto/elliptic)
../../../go/pkg/mod/github.com/!masterminds/sprig/v3@v3.3.0/crypto.go:8:2: package crypto/dsa is not in std (/usr/lib/go-1.23/src/crypto/dsa)
../../../go/pkg/mod/github.com/!masterminds/sprig/v3@v3.3.0/strings.go:4:2: package encoding/base32 is not in std (/usr/lib/go-1.23/src/encoding/base32)
../../../go/pkg/mod/github.com/!masterminds/sprig/v3@v3.3.0/crypto.go:27:2: package hash/adler32 is not in std (/usr/lib/go-1.23/src/hash/adler32)
../../../go/pkg/mod/github.com/!masterminds/sprig/v3@v3.3.0/functions.go:13:2: package text/template is not in std (/usr/lib/go-1.23/src/text/template)
../../../go/pkg/mod/github.com/go-jose/go-jose/v3@v3.0.3/encoding.go:21:2: package compress/flate is not in std (/usr/lib/go-1.23/src/compress/flate)
../../../go/pkg/mod/golang.org/x/crypto@v0.29.0/ssh/cipher.go:10:2: package crypto/des is not in std (/usr/lib/go-1.23/src/crypto/des)
../../../go/pkg/mod/golang.org/x/crypto@v0.29.0/ssh/cipher.go:11:2: package crypto/rc4 is not in std (/usr/lib/go-1.23/src/crypto/rc4)
../../../go/pkg/mod/golang.org/x/oauth2@v0.24.0/internal/token.go:15:2: package mime is not in std (/usr/lib/go-1.23/src/mime)
../../../go/pkg/mod/github.com/russross/blackfriday/v2@v2.1.0/block.go:18:2: package html is not in std (/usr/lib/go-1.23/src/html)
../../../go/pkg/mod/github.com/chzyer/readline@v1.5.1/utils.go:9:2: package os/signal is not in std (/usr/lib/go-1.23/src/os/signal)
../../../go/pkg/mod/golang.org/x/net@v0.31.0/html/iter.go:9:8: package iter is not in std (/usr/lib/go-1.23/src/iter)
../../../go/pkg/mod/github.com/smallstep/pkcs7@v0.0.0-20240911091500-b1cae6277023/verify_test_dsa.go:11:2: package os/exec is not in std (/usr/lib/go-1.23/src/os/exec)
../../../go/pkg/mod/github.com/smallstep/pkcs7@v0.0.0-20240911091500-b1cae6277023/verify_test_dsa.go:12:2: package testing is not in std (/usr/lib/go-1.23/src/testing)
../../../go/pkg/mod/github.com/googleapis/enterprise-certificate-proxy@v0.3.4/client/client.go:24:2: package encoding/gob is not in std (/usr/lib/go-1.23/src/encoding/gob)
../../../go/pkg/mod/github.com/googleapis/enterprise-certificate-proxy@v0.3.4/client/client.go:28:2: package net/rpc is not in std (/usr/lib/go-1.23/src/net/rpc)
../../../go/pkg/mod/google.golang.org/api@v0.206.0/internal/settings.go:11:2: package log/slog is not in std (/usr/lib/go-1.23/src/log/slog)
../../../go/pkg/mod/go.opencensus.io@v0.24.0/trace/trace_go11.go:22:2: package runtime/trace is not in std (/usr/lib/go-1.23/src/runtime/trace)
../../../go/pkg/mod/go.opentelemetry.io/otel@v1.29.0/attribute/set.go:7:2: package cmp is not in std (/usr/lib/go-1.23/src/cmp)
../../../go/pkg/mod/github.com/go-chi/chi/v5@v5.1.0/middleware/profiler.go:6:2: package net/http/pprof is not in std (/usr/lib/go-1.23/src/net/http/pprof)
../../../go/pkg/mod/github.com/prometheus/client_golang@v1.20.5/prometheus/internal/go_runtime_metrics.go:22:2: package runtime/metrics is not in std (/usr/lib/go-1.23/src/runtime/metrics)
../../../go/pkg/mod/github.com/hashicorp/vault/api@v1.15.0/sys_raft.go:7:2: package archive/tar is not in std (/usr/lib/go-1.23/src/archive/tar)
../../../go/pkg/mod/github.com/aws/aws-sdk-go@v1.49.22/private/protocol/query/unmarshal.go:6:2: package encoding/xml is not in std (/usr/lib/go-1.23/src/encoding/xml)
../../../go/pkg/mod/github.com/!azure/azure-sdk-for-go/sdk/azcore@v1.16.0/runtime/request.go:17:2: package mime/multipart is not in std (/usr/lib/go-1.23/src/mime/multipart)
../../../go/pkg/mod/github.com/peterbourgon/diskv/v3@v3.0.1/compression.go:6:2: package compress/zlib is not in std (/usr/lib/go-1.23/src/compress/zlib)
make: *** [Makefile:90: bin/step-ca] Error

[hslatman]

This is the output of strings step-ca | grep -i yubikey | tee $(date -Is)-$(basename $(dirname $(pwd)/.)).strings.log on the build machine. 2024-12-09T13:35:05+01:00-step-ca.strings.log

That output looks like YubiKey is indeed compiled in that build. There's more references to code that's in the YubiKey package; not just the parts that I expect when it was included in the build, but with support disabled.

When I've came back a few days later I've discovered that there is a different step-ca in the base build directory, different in the bin directory and make install via checkinstall gives a third binary, which checksum matches the one that doesn't have YK build in on the VM.

❯ sha256sum step-ca ./bin/step-ca usr/local/bin/step-ca | egrep -i 'a4fddf475a2adfa41289049fd1ece9e7e933187c95ee447060207e5bb6c5744d|'
323afc755f340b13ae5a03e8b99921dfcf04a9a8ae6f130881b38eec504d17ed  step-ca
05d02513df91dbaa0f73b3eea0fa5b800cc1c87298b23e601f9ce6526ff9af20  ./bin/step-ca
a4fddf475a2adfa41289049fd1ece9e7e933187c95ee447060207e5bb6c5744d  usr/local/bin/step-ca

And I'm stumped, as I didn't ever have such issues with checkinstall.

Edit: something doesn't sit right with me. I thought I made a mistake and built without CGO_ENABLED. (a4fddf475a2adfa41289049fd1ece9e7e933187c95ee447060207e5bb6c5744d is the checksum of step-ca taken from the target VM, where it was installed by a package created by checkinstall)

❯ make clean && make build && make INSTALL_PREFIX=. install && sha256sum step-ca ./bin/step-ca usr/local/bin/step-ca | egrep -i 'a4fddf475a2adfa41289049fd1ece9e7e933187c95ee447060207e5bb6c5744d|'
github.com/smallstep/certificates/cmd/step-ca
Build Complete!
323afc755f340b13ae5a03e8b99921dfcf04a9a8ae6f130881b38eec504d17ed  step-ca
0601641bf20e77ff946a0ba42af853a9c6fc490b012e89e92d29faa8c7da1ae6  ./bin/step-ca
25c7ce2a3dc49dedecf47c3e876485e620e92e503e46d7711af6a90d2c14e77d  usr/local/bin/step-ca

Yet, when I corrected my mistake I saw this:

❯ make clean && make build GO_ENVS="CGO_ENABLED=1" && make INSTALL_PREFIX=. install && sha256sum step-ca ./bin/step-ca usr/local/bin/step-ca | egrep -i 'a4fddf475a2adfa41289049fd1ece9e7e933187c95ee447060207e5bb6c5744d|'
github.com/smallstep/certificates/cmd/step-ca
Build Complete!
github.com/smallstep/certificates/cmd/step-ca
323afc755f340b13ae5a03e8b99921dfcf04a9a8ae6f130881b38eec504d17ed  step-ca
d8af698a5f86767b784b0ba0bc63b12869ea94997116de621f9291ba68b8c1c9  ./bin/step-ca
25c7ce2a3dc49dedecf47c3e876485e620e92e503e46d7711af6a90d2c14e77d  usr/local/bin/step-ca

In summary:

* `./step-ca` is the same with and without CGO enabled,

* `./bin/step-ca` is the one I should focus on,

* `make install` creates a completely different package now,

* `make install` itself outputs the string `github.com/smallstep/certificates/cmd/step-ca`, which suggests that it downloads the package.

Edit 2: Does really make install download a ready package, instead of using the already built one‽‽‽

❯ firejail --net=none make INSTALL_PREFIX=. install
cmd/step-ca/main.go:4:2: package flag is not in std (/usr/lib/go-1.23/src/flag)
cmd/step-ca/main.go:5:2: package fmt is not in std (/usr/lib/go-1.23/src/fmt)

I haven't looked into make install very deeply yet, but I think the reason the binary may have a different checksum is because make build will ultimately build the binary with the current date in it: https://github.com/smallstep/certificates/blob/master/Makefile#L62-L63. It's probably possible to enforce a specific date for a specific version with some additional scripting and such, but I'd say it's a different issue from the one that's at hand now?

[DDzwiedziu]

I haven't looked into make install very deeply yet, but I think the reason the binary may have a different checksum is because make build will ultimately build the binary with the current date in it: https://github.com/smallstep/certificates/blob/master/Makefile#L62-L63. It's probably possible to enforce a specific date for a specific version with some additional scripting and such, but I'd say it's a different issue from the one that's at hand now?

I might be old, yet in #mytimes make install used the binaries from the previous make not create or download new ones. So the date in the build process should not matter.

But yes, this is another issue I should file a bug against.

[hslatman]

I haven't looked into make install very deeply yet, but I think the reason the binary may have a different checksum is because make build will ultimately build the binary with the current date in it: https://github.com/smallstep/certificates/blob/master/Makefile#L62-L63. It's probably possible to enforce a specific date for a specific version with some additional scripting and such, but I'd say it's a different issue from the one that's at hand now?

I might be old, yet in #mytimes make install used the binaries from the previous make not create or download new ones. So the date in the build process should not matter.

But yes, this is another issue I should file a bug against.

Ah, now I understand what you mean. Yes, it sounds like it doesn't behave like a "regular" make target in this case. It could be due to the .PHONY usage? To be honest I think a Makefile in Go projects is generally just there to make it easy to invoke some commands, and doesn't always follow the usual practices, but that's just my experience and 2c 😅

How are things looking for your original issue with the YubiKey support?

[DDzwiedziu]

How are things looking for your original issue with the YubiKey support?

I am slowly losing my sanity. Edit: was about to, but changed the binary used.

Copied the supposedly compiled bin/step-ca to the target machine, but:

root@ca:~# sudo -u step ./step-ca /etc/step-ca/config/ca.json
sudo: unable to execute ./step-ca: Permission denied
root@ca:~# chmod +x step-ca
root@ca:~# sudo -u step ./step-ca /etc/step-ca/config/ca.json
sudo: unable to execute ./step-ca: Permission denied
root@ca:~# chown step:step step-ca
root@ca:~# sudo -u step ./step-ca /etc/step-ca/config/ca.json
sudo: unable to execute ./step-ca: Permission denied
root@ca:~# ls -hal ./step-ca
-rwxr-xr-x 1 step step 48M Dec 12 18:49 ./step-ca
root@ca:~# ./step-ca
badger 2024/12/12 18:53:09 INFO: All 1 tables opened in 2ms
badger 2024/12/12 18:53:09 INFO: Replaying file id: 0 at offset: 2982
badger 2024/12/12 18:53:09 INFO: Replay took: 435.246_s
unsupported kms type 'yubikey': step-ca is compiled without cgo or YubiKey support

When I copied ./step-ca it started to work. Just need to figure out what's with the permissions. Dumb thing: tried to run from directory user step did not have access. Now to figure out dropping privileges after acquiring port 443. Missed the setcap step.