Add FIPS build.

Makefile

@@ -77,10 +77,17 @@ download:
 build: $(PREFIX)bin/$(BINNAME)
 	@echo "Build Complete!"
 
+build-fips: $(PREFIX)bin/$(BINNAME).fips
+	@echo "Build Complete!"
+
 $(PREFIX)bin/$(BINNAME): download $(call rwildcard,*.go)
 	$Q mkdir -p $(@D)
 	$Q $(GOOS_OVERRIDE) $(CGO_OVERRIDE) go build -v -o $@ $(GCFLAGS) $(LDFLAGS) $(PKG)
 
+$(PREFIX)bin/$(BINNAME).fips: download $(call rwildcard,*.go)
+	$Q mkdir -p $(@D)
+	$Q $(GOOS_OVERRIDE) $(CGO_OVERRIDE) GOEXPERIMENT="boringcrypto" go build -v -o $@ $(GCFLAGS) $(LDFLAGS) $(PKG)
+
 .PHONY: build simple
 
 #########################################

docker/Dockerfile.fips

@@ -0,0 +1,43 @@
+FROM --platform=$BUILDPLATFORM golang:alpine AS builder
+
+WORKDIR /src
+COPY go.mod go.sum .
+RUN go mod download
+COPY . .
+RUN apk add --no-cache make git curl
+
+ARG TARGETOS
+ARG TARGETARCH
+ARG TARGETVARIANT
+RUN --mount=type=cache,target=/root/.cache/go-build \
+    --mount=type=cache,target=/go/pkg \
+    GOOS="${TARGETOS}"; \
+    GOARCH="${TARGETARCH}"; \
+    if [ "${TARGETARCH}" = "arm" ] && [ "${TARGETVARIANT}" ]; then \
+    GOARM="${TARGETVARIANT#v}"; \
+    fi; \
+    CGO_ENABLED=0 GOOS_OVERRIDE="GOOS=${GOOS} GOARCH=${GOARCH} GOARM=${GOARM}" \
+    make V=1 build-fips
+
+FROM smallstep/alpine-fips
+
+ENV STEP="/home/step"
+ENV STEPPATH="/home/step"
+ARG STEPUID=1000
+ARG STEPGID=1000
+
+RUN apk update \
+        && apk upgrade \
+        && apk add --no-cache bash curl tzdata \
+        && addgroup -g ${STEPGID} step \
+        && adduser -D -u ${STEPUID} -G step step \
+        && chown step:step /home/step
+
+COPY --from=builder /src/bin/step.fips "/usr/local/bin/step"
+
+USER step
+WORKDIR /home/step
+
+STOPSIGNAL SIGTERM
+
+CMD /bin/bash