diff options
| author | Daniel Morsing <daniel.morsing@gmail.com> | 2025-11-24 13:08:10 +0000 |
|---|---|---|
| committer | Gopher Robot <gobot@golang.org> | 2025-11-26 14:26:06 -0800 |
| commit | 86bbea0cfa72041fb4315eb22099b0bc83caa314 (patch) | |
| tree | 3c3a008214e4a9d929a2d8f76f98fe1cf2f323d2 /src/crypto/internal | |
| parent | e2cae9ecdf944a1cc5d8803ff8932180858b8ce6 (diff) | |
| download | go-86bbea0cfa72041fb4315eb22099b0bc83caa314.tar.xz | |
crypto/fips140: add WithoutEnforcement
WithoutEnforcement lets programs running under GODEBUG=fips140=only
selectively opt out of strict enforcement. This is especially helpful
for non-critical uses of cryptography routines like SHA-1 for content
addressable storage backends (E.g. git).
Fixes #74630
Change-Id: Iabba1f5eb63498db98047aca45e09c5dccf2fbdf
Reviewed-on: https://go-review.googlesource.com/c/go/+/723720
Reviewed-by: Dmitri Shuralyov <dmitshur@google.com>
Reviewed-by: Filippo Valsorda <filippo@golang.org>
Auto-Submit: Filippo Valsorda <filippo@golang.org>
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
Reviewed-by: Roland Shoemaker <roland@golang.org>
Diffstat (limited to 'src/crypto/internal')
| -rw-r--r-- | src/crypto/internal/fips140only/fips140only.go | 8 |
1 files changed, 5 insertions, 3 deletions
diff --git a/src/crypto/internal/fips140only/fips140only.go b/src/crypto/internal/fips140only/fips140only.go index 147877a34f..1b0a4be6ba 100644 --- a/src/crypto/internal/fips140only/fips140only.go +++ b/src/crypto/internal/fips140only/fips140only.go @@ -5,18 +5,20 @@ package fips140only import ( + "crypto/fips140" "crypto/internal/fips140/drbg" "crypto/internal/fips140/sha256" "crypto/internal/fips140/sha3" "crypto/internal/fips140/sha512" "hash" - "internal/godebug" "io" ) -// Enabled reports whether FIPS 140-only mode is enabled, in which non-approved +// Enforced reports whether FIPS 140-only mode is enabled and enforced, in which non-approved // cryptography returns an error or panics. -var Enabled = godebug.New("fips140").Value() == "only" +func Enforced() bool { + return fips140.Enforced() +} func ApprovedHash(h hash.Hash) bool { switch h.(type) { |