personal_interest_mirrors/nebula
1
0
Fork 0
mirror of https://github.com/slackhq/nebula.git synced 2026-08-15 09:57:00 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity

use go:debug to enable fips140=only

Browse Source 
This is safer because it doesn't clober other defaults that are set by
Go or the environment.
This commit is contained in:
Wade Simmons
2026-07-08 10:41:24 -04:00
parent 14c9288127
commit 6675f5a361
4 changed files with 15 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Makefile
-2
View File
@@ -197,7 +197,6 @@ build/linux-arm64-boringcrypto/%: GOENV += GOEXPERIMENT=boringcrypto CGO_ENABLED
# fips140 # fips140
$(foreach _rule, $(ALL_FIPS140), build/$(_rule)/%): GOENV += GOFIPS140=v1.0.0 $(foreach _rule, $(ALL_FIPS140), build/$(_rule)/%): GOENV += GOFIPS140=v1.0.0
$(foreach _rule, $(ALL_FIPS140), build/$(_rule)/%): LDFLAGS += -X runtime.godebugDefault=fips140=only
$(foreach _rule, $(ALL_FIPS140), build/$(_rule)/%): BUILD_ARGS += -tags fips140enforce $(foreach _rule, $(ALL_FIPS140), build/$(_rule)/%): BUILD_ARGS += -tags fips140enforce
build/%/nebula: .FORCE build/%/nebula: .FORCE
@@ -282,7 +281,6 @@ ifeq ($(strip $(GOFIPS140)),)
$(eval GOFIPS140 = v1.0.0) $(eval GOFIPS140 = v1.0.0)
endif endif
$(eval GOENV += GOFIPS140=$(GOFIPS140)) $(eval GOENV += GOFIPS140=$(GOFIPS140))
$(eval LDFLAGS += -X runtime.godebugDefault=fips140=only)
$(eval BUILD_ARGS += -tags fips140enforce) $(eval BUILD_ARGS += -tags fips140enforce)
$(eval TEST_ENV += $(GOENV)) $(eval TEST_ENV += $(GOENV))
$(eval CURVE = P256) $(eval CURVE = P256)
cmd/nebula-cert/fips140enforce.go
+5
View File
@@ -0,0 +1,5 @@
//go:build fips140enforce
//go:debug fips140=only
package main
cmd/nebula-service/fips140enforce.go
+5
View File
@@ -0,0 +1,5 @@
//go:build fips140enforce
//go:debug fips140=only
package main
cmd/nebula/fips140enforce.go
+5
View File
@@ -0,0 +1,5 @@
//go:build fips140enforce
//go:debug fips140=only
package main