build: revert Go native certified FIPS 140-3 cryptography on main - #1953
Conversation
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request transitions the build pipeline from using noboringcrypto and GOFIPS140=certified (with CGO disabled) to boringcrypto with CGO_ENABLED=1 and GOFIPS140=off. It updates the Dockerfiles to support cross-compilation with CGO enabled, switches to a glibc-based distroless image, and introduces a boring.go file in each component to import crypto/tls/fipsonly. However, the reviewer identified a critical issue across all components: the build tag in the new boring.go files is incorrectly set to boring instead of boringcrypto, which would prevent the FIPS-only TLS enforcement from being compiled in.
This replicates the approach from PR #1952 onto the main branch, reverting the adoption of Go 1.26 native FIPS mode (`crypto/fips140`, `GOFIPS140=certified`) and restoring dynamic linking with `BoringCrypto` (`gke-distroless/libc`, `GOEXPERIMENT=boringcrypto`, `CGO_ENABLED=1`), without altering `golangci-lint` configuration.
4daa691 to
0d1f390
Compare
|
/gemini review |
There was a problem hiding this comment.
Code Review
This pull request transitions the build configuration from using noboringcrypto (with GOFIPS140=certified and CGO_ENABLED=0) to standard boringcrypto (with GOFIPS140=off and CGO_ENABLED=1). To support CGO, the Dockerfiles are updated to install cross-compilation toolchains (gcc and libc cross-compilers) when building for different target architectures, and the final base images are switched to a distroless variant that includes libc. Additionally, explicit FIPS initialization checks are removed from the main.go files, and a new boring.go file is introduced in each command package to import crypto/tls/fipsonly under the experiment.boringcrypto build tag. There are no review comments, so I have no feedback to provide.
2 participants
This replicates the approach from PR #1952 onto the main branch, reverting the adoption of Go 1.26 native FIPS mode (
crypto/fips140,GOFIPS140=certified) and restoring dynamic linking withBoringCrypto(gke-distroless/libc,GOEXPERIMENT=boringcrypto,CGO_ENABLED=1), without alteringgolangci-lintconfiguration.