Build releases against the FIPS 140-3 validated Go crypto module - #6262
Merged
Conversation
Collaborator
Integration test reportCommit: 4a81d9b
8 interesting tests: 4 SKIP, 3 KNOWN, 1 RECOVERED
Top 6 slowest tests (at least 2 minutes):
|
ilyakuz-db
force-pushed
the
fips140-release-build
branch
4 times, most recently
from
August 17, 2026 09:31
2c52d0c to
85233e3
Compare
varundeepsaini
pushed a commit
to varundeepsaini/cli
that referenced
this pull request
Aug 17, 2026
…icks#6193) ## Changes Sets `GOFIPS140=v1.0.0` in `Taskfile.yml`, so every `task` invocation builds the CLI against the FIPS 140-3 validated Go Cryptographic Module. Adds a test that reads the built binary's build info to confirm it really was built with it. ## Why Releases are moving to FIPS builds (databricks#6262). Go picks its cryptographic module at build time, so testing without it exercises a configuration we no longer ship. In the Taskfile rather than a workflow env because every consumer goes through `task` — local `./task test`, CI's `task test`, and the integration suite, which runs `task integration` from eng-dev-ecosystem. One line covers all three, with no cross-repo change. Bare `go test` outside `task` is not covered, so the check fails there rather than silently passing. Worth flagging: this makes eng-dev-ecosystem integration runs FIPS without a change in that repo. ## Tests Full unit + acceptance suite under FIPS, locally and in CI (all six cells, macOS and Windows included) — no failures. Integration against real workspaces under FIPS: ~11,000 tests across six cells (three clouds x linux/windows), and the FIPS check passed in every cell. The four unrelated failures were a leftover-state 409 on AWS and three cluster timing flakes; baseline nightlies show the same rate without FIPS. Perf: CLI startup 12ms -> 13ms, RSA-4096 key generation 653ms -> 1.35s. The new build tag invalidates the Go build cache once, so the first build after this merges is a full rebuild.
pietern
approved these changes
Aug 17, 2026
| @@ -0,0 +1 @@ | |||
| Released binaries are now built against the FIPS 140-3 validated Go Cryptographic Module, with FIPS 140-3 mode enabled by default. TLS connections negotiate only FIPS-approved cipher suites, which drops ChaCha20 and CBC from what the client offers. FIPS mode can be disabled at startup with `GODEBUG=fips140=off`, which restores the previous TLS behaviour ([#6262](https://github.com/databricks/cli/pull/6262)). | |||
Contributor
There was a problem hiding this comment.
Is this really notable? We could move it to the CLI section.
Contributor
Author
There was a problem hiding this comment.
Updated, moved to the cli/
ilyakuz-db
force-pushed
the
fips140-release-build
branch
from
August 17, 2026 09:41
85233e3 to
3c7c16a
Compare
Contributor
|
@ilyakuz-db I triggered a rerun (and investigation) of the most recent failure. Looks like a flake. |
Contributor
Author
Thanks! |
andrewnester
approved these changes
Aug 17, 2026
ilyakuz-db
force-pushed
the
fips140-release-build
branch
from
August 18, 2026 09:47
3c7c16a to
4a81d9b
Compare
denik
approved these changes
Aug 18, 2026
denik
reviewed
Aug 18, 2026
| # cite, and "certified" is resolved by the toolchain so it moves on upgrade. | ||
| # Callers who need the previous behaviour can start the binary with | ||
| # GODEBUG=fips140=off. | ||
| - GOFIPS140=v1.0.0 |
Contributor
There was a problem hiding this comment.
Why not just do top level env in this Taskfile with this setting to ensure that we run all test with it as well?
Contributor
Author
There was a problem hiding this comment.
We have this for tests #6193
But if I understood correctly, Taskfile doesn't cover goreleaser flow, and we still need to set env here
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
5 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Changes
Build released binaries with
GOFIPS140=v1.0.0. This links the FIPS 140-3 validated Go Cryptographic Module into the binary and defaults FIPS 140-3 mode on, so no runtime flag is needed.Why
Regulated environments (FedRAMP, IL5) require cryptography to come from a validated module. This has to be set at build time: the runtime
GODEBUG=fips140=ononly toggles the mode on whatever module was already linked, so without the build variable, there is no validated module in the binary and no certificate to cite.Pinned to a frozen version rather than an alias.
v1.0.0is the version covered by CMVP certificate#5247This changes behavior for everyone, not just regulated users: the TLS client offers only FIPS-approved suites (6 instead of 13, dropping ChaCha20 and CBC)
CI coverage for the FIPS build is added separately in #6193
Tests
Ran the whole unit and acceptance suite against a FIPS build — no failures. Also confirmed all six release targets (linux/darwin/windows x amd64/arm64) cross-compile with the variable set; none of the platforms Go excludes from FIPS mode are in our matrix.
This PR was written by Claude Code.