Problem: GO binaries need to be compiled with FIPS crypto support Fix By: Compiling CGO_ENABLED=1 Waive If: The application does not use crypto Example: FAIL: fips test because the binary loaded a non-FIPS compliant crypto library
By default when using Fedora, applications written in GO use cryptographic functions from the GO standard library, which is not FIPS-validated. RHEL however is based on upstream GO’s dev.boringcrypto branch, which is modified to use BoringSSL for crypto primitives. These are FIPS-validated.
For the best security GO applications should use a FIPS-validated cryptographic library, and this test checks for this behaviour.
This is automatically disabled if a Fedora profile is used.
If necessary the test can be disabled via the --skip-fips option or re-enabled via the --test-fips option.