diff options
| author | Filippo Valsorda <filippo@golang.org> | 2024-12-17 19:57:54 +0100 |
|---|---|---|
| committer | Gopher Robot <gobot@golang.org> | 2024-12-18 08:49:21 -0800 |
| commit | 8ff4cee56491eeb3ce146974109cb4893ef5cbd6 (patch) | |
| tree | b71aeb421e34534db2be7ce2bcb9c8fabdda7b26 /src/crypto | |
| parent | 971448ddf8c55a5f4a829735a5a96cacf982f230 (diff) | |
| download | go-8ff4cee56491eeb3ce146974109cb4893ef5cbd6.tar.xz | |
cmd/go,crypto: reject using Go+BoringCrypto and fips140 together
The combination is untested and nonsensical. Both are solutions to the
same problem.
For #69536
Change-Id: I95cc3baaf03b64ce08096e304e311a29e9577385
Reviewed-on: https://go-review.googlesource.com/c/go/+/637177
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
Reviewed-by: Russ Cox <rsc@golang.org>
Auto-Submit: Filippo Valsorda <filippo@golang.org>
Reviewed-by: David Chase <drchase@google.com>
Diffstat (limited to 'src/crypto')
| -rw-r--r-- | src/crypto/internal/boring/boring.go | 7 | ||||
| -rw-r--r-- | src/crypto/internal/fips140test/check_test.go | 5 |
2 files changed, 12 insertions, 0 deletions
diff --git a/src/crypto/internal/boring/boring.go b/src/crypto/internal/boring/boring.go index 90cf1edb75..6dfc6ed5f5 100644 --- a/src/crypto/internal/boring/boring.go +++ b/src/crypto/internal/boring/boring.go @@ -16,6 +16,7 @@ import "C" import ( "crypto/internal/boring/sig" _ "crypto/internal/boring/syso" + "crypto/internal/fips140" "internal/stringslite" "math/bits" "unsafe" @@ -31,6 +32,12 @@ func init() { sig.BoringCrypto() } +func init() { + if fips140.Enabled { + panic("boringcrypto: cannot use GODEBUG=fips140 with GOEXPERIMENT=boringcrypto") + } +} + // Unreachable marks code that should be unreachable // when BoringCrypto is in use. It panics. func Unreachable() { diff --git a/src/crypto/internal/fips140test/check_test.go b/src/crypto/internal/fips140test/check_test.go index b156de2cbb..cf42dbfa78 100644 --- a/src/crypto/internal/fips140test/check_test.go +++ b/src/crypto/internal/fips140test/check_test.go @@ -5,6 +5,7 @@ package fipstest import ( + "crypto/internal/boring" . "crypto/internal/fips140/check" "crypto/internal/fips140/check/checktest" "fmt" @@ -22,6 +23,10 @@ import ( const enableFIPSTest = true func TestFIPSCheckVerify(t *testing.T) { + if boring.Enabled { + t.Skip("not testing fips140 with boringcrypto enabled") + } + if Verified { t.Logf("verified") return |