go source for verification 2026-05-22

lib/fips140/Makefile

@@ -0,0 +1,46 @@
+# Copyright 2024 The Go Authors. All rights reserved.
+# Use of this source code is governed by a BSD-style
+# license that can be found in the LICENSE file.
+
+# Rules for building and testing new FIPS snapshots.
+# For example:
+#
+#	make v1.2.3.zip
+#	make v1.2.3.test
+#
+# and then if changes are needed, check them into master
+# and run 'make v1.2.3.rm' and repeat.
+#
+# Note that once published a snapshot zip file should never
+# be modified. We record the sha256 hashes of the zip files
+# in fips140.sum, and the cmd/go/internal/fips140 test checks
+# that the zips match.
+#
+# When the zip file is finalized, run 'make updatesum' to update
+# fips140.sum.
+
+default:
+	@echo nothing to make
+
+# make v1.2.3.zip builds a v1.2.3.zip file
+# from the current origin/master.
+# copy and edit the 'go run' command by hand to use a different branch.
+v%.zip:
+	git fetch origin master
+	go run ../../src/cmd/go/internal/fips140/mkzip.go v$*
+
+# normally mkzip refuses to overwrite an existing zip file.
+# make v1.2.3.rm removes the zip file and unpacked
+# copy from the module cache.
+v%.rm:
+	rm -f v$*.zip
+	chmod -R u+w $$(go env GOMODCACHE)/golang.org/fips140@v$* 2>/dev/null || true
+	rm -rf $$(go env GOMODCACHE)/golang.org/fips140@v$*
+
+# make v1.2.3.test runs the crypto tests using that snapshot.
+v%.test:
+	GOFIPS140=v$* go test -short crypto...
+
+# make updatesum updates the fips140.sum file.
+updatesum:
+	go test cmd/go/internal/fips140 -update

lib/fips140/README.md

@@ -0,0 +1,9 @@
+This directory holds snapshots of the crypto/internal/fips140 tree
+that are being validated and certified for FIPS-140 use.
+The file x.txt (for example, inprocess.txt, certified.txt)
+defines the meaning of the FIPS version alias x, listing
+the exact version to use.
+
+The zip files are created by cmd/go/internal/fips140/mkzip.go.
+The fips140.sum file lists checksums for the zip files.
+See the Makefile for recipes.

lib/fips140/fips140.sum

@@ -0,0 +1,13 @@
+# SHA256 checksums of snapshot zip files in this directory.
+# These checksums are included in the FIPS security policy
+# (validation instructions sent to the lab) and MUST NOT CHANGE.
+# That is, the zip files themselves must not change.
+#
+# It is okay to add new zip files to the list, and it is okay to
+# remove zip files from the list when they are removed from
+# this directory. To update this file:
+#
+#	go test cmd/go/internal/fips140 -update
+#
+v1.0.0-c2097c7c.zip daf3614e0406f67ae6323c902db3f953a1effb199142362a039e7526dfb9368b
+v1.26.0.zip 9b28f847fdf1db4a36cb2b2f8ec09443c039383f085630a03ecfaddf6db7ea23

lib/fips140/inprocess.txt

@@ -0,0 +1 @@
+v1.0.0-c2097c7c

lib/fips140/v1.0.0.txt

@@ -0,0 +1 @@
+v1.0.0-c2097c7c