FIPS compliant builds

[michel-laterman]

What is the problem this PR solves?

Add ability to make FIPS compliant builds when FIPS=true is specified.

How does this PR solve the problem?

Specifying FIPS=true will change the following:

• PLATFORMS will default to linux/amd64 linux/arm64
• make local, make release-* - Binary will be build with -tags=fipsrequired and GOEXPERIMENT=systemcrypto
• make build-releaser - chaingaurd microsoft go image will be used as base
• make multipass - microsoft's go toolchain will be downloaded and installed to VM

How to test this PR locally

Design Checklist

• I have ensured my design is stateless and will work when multiple fleet-server instances are behind a load balancer.
• I have or intend to scale test my changes, ensuring it will work reliably with 100K+ agents connected.
• I have included fail safe mechanisms to limit the load on fleet-server: rate limiting, circuit breakers, caching, load shedding, etc.

Checklist

• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
• I have made corresponding change to the default configuration files
• I have added tests that prove my fix is effective or that my feature works
• I have added an entry in ./changelog/fragments using the changelog tool

Related issues

[mergify]

This pull request does not have a backport label. Could you fix it @michel-laterman? 🙏
To fixup this pull request, you need to add the backport labels for the needed
branches, such as:

• backport-./d./d is the label to automatically backport to the 8./d branch. /d is the digit

[mergify]

backport-8.x has been added to help with the transition to the new branch 8.x.
If you don't need it please use backport-skip label and remove the backport-8.x label.

[michel-laterman]

I'm working off an ARM macbook.

When I try to compile these targets in the image built by Dockerfile.fips (base stage) by running FIPS=true make docker-release, I get gcc: error: unrecognized command-line option '-m64' when it tries to compile for linux/amd64. (linux/arm64 compiles as expected if platforms are re-ordered)

However if I run the microsoft/golang base dockerfile with --platform=linux/amd64 I can compile for linux/amd64 with no issue, and I can compile for linux/arm64 if I add CC=x86_64-linux-gnu-gcc.

[cmacknz]

This is all expected if the host gcc was only built to target the host machine architecture, which I think is typical for gcc. gcc -dumpmachine will tell you the target triple, it'd be weird if it were also x86_64-linux-gnu-gcc. Probably there is some series of command line options that can dump out the supported architectures.

The work arounds are the ones you've listed here:

1. Run the container with --platform=linux/amd64 to have your ARM Mac emulate x86. This is the slowest option.
2. Explicitly specify a cross toolchain. This is the fastest option because you don't have to emulate. You can likely select the correct toolchain conditionally, this is what https://github.com/elastic/beats/pull/40330/files did to avoid emulation by default.

The CI machines will never have to cross compile because you can always use one with the correct host architecture.

[blakerouse]

Nothing stands out that worries me in this PR. Being it has to directly be enabled to build, this looks good.

[elastic-sonarqube]

Quality Gate failed

Failed conditions
4 Security Hotspots

See analysis details on SonarQube

[michalpristas]

💙