requires go1.26

fips140.go

@@ -2,16 +2,30 @@ package nebula
 
 import (
 	"crypto/fips140"
-	"fmt"
+	"runtime/debug"
 )
 
-func fips140version() string {
+func getFIPS140() string {
 	switch {
 	case fips140.Enforced():
-		return fmt.Sprintf("only,version=%s", fips140.Version())
+		return "only"
 	case fips140.Enabled():
-		return fmt.Sprintf("on,version=%s", fips140.Version())
+		return "on"
 	default:
 		return "off"
 	}
 }
+
+func getFIPS140Version() string {
+	// The docs for fips140.Version mention this is more accurate to
+	// get the exact version
+	info, ok := debug.ReadBuildInfo()
+	if ok {
+		for _, s := range info.Settings {
+			if s.Key == "GOFIPS140" {
+				return s.Value
+			}
+		}
+	}
+	return fips140.Version()
+}