From 6675f5a36144ba823a5e2f233f4ab7470d2616ee Mon Sep 17 00:00:00 2001
From: Wade Simmons <wsimmons@slack-corp.com>
Date: Wed, 8 Jul 2026 10:41:24 -0400
Subject: [PATCH] use go:debug to enable fips140=only

This is safer because it doesn't clober other defaults that are set by
Go or the environment.
---
 Makefile                             | 2 --
 cmd/nebula-cert/fips140enforce.go    | 5 +++++
 cmd/nebula-service/fips140enforce.go | 5 +++++
 cmd/nebula/fips140enforce.go         | 5 +++++
 4 files changed, 15 insertions(+), 2 deletions(-)
 create mode 100644 cmd/nebula-cert/fips140enforce.go
 create mode 100644 cmd/nebula-service/fips140enforce.go
 create mode 100644 cmd/nebula/fips140enforce.go

diff --git a/Makefile b/Makefile
index 6984c459..d94a4d9e 100644
--- a/Makefile
+++ b/Makefile
@@ -197,7 +197,6 @@ build/linux-arm64-boringcrypto/%: GOENV += GOEXPERIMENT=boringcrypto CGO_ENABLED
 
 # fips140
 $(foreach _rule, $(ALL_FIPS140), build/$(_rule)/%): GOENV += GOFIPS140=v1.0.0
-$(foreach _rule, $(ALL_FIPS140), build/$(_rule)/%): LDFLAGS += -X runtime.godebugDefault=fips140=only
 $(foreach _rule, $(ALL_FIPS140), build/$(_rule)/%): BUILD_ARGS += -tags fips140enforce
 
 build/%/nebula: .FORCE
@@ -282,7 +281,6 @@ ifeq ($(strip $(GOFIPS140)),)
 	$(eval GOFIPS140 = v1.0.0)
 endif
 	$(eval GOENV += GOFIPS140=$(GOFIPS140))
-	$(eval LDFLAGS += -X runtime.godebugDefault=fips140=only)
 	$(eval BUILD_ARGS += -tags fips140enforce)
 	$(eval TEST_ENV += $(GOENV))
 	$(eval CURVE = P256)
diff --git a/cmd/nebula-cert/fips140enforce.go b/cmd/nebula-cert/fips140enforce.go
new file mode 100644
index 00000000..3dad1648
--- /dev/null
+++ b/cmd/nebula-cert/fips140enforce.go
@@ -0,0 +1,5 @@
+//go:build fips140enforce
+
+//go:debug fips140=only
+
+package main
diff --git a/cmd/nebula-service/fips140enforce.go b/cmd/nebula-service/fips140enforce.go
new file mode 100644
index 00000000..3dad1648
--- /dev/null
+++ b/cmd/nebula-service/fips140enforce.go
@@ -0,0 +1,5 @@
+//go:build fips140enforce
+
+//go:debug fips140=only
+
+package main
diff --git a/cmd/nebula/fips140enforce.go b/cmd/nebula/fips140enforce.go
new file mode 100644
index 00000000..3dad1648
--- /dev/null
+++ b/cmd/nebula/fips140enforce.go
@@ -0,0 +1,5 @@
+//go:build fips140enforce
+
+//go:debug fips140=only
+
+package main