Neal Patel
819eab448b
Instead of providing a carve-out for the golang.org/fips module, add the canonical go.sum h1 hash to its trusted fips140.sum file. When a modfetch would normally see this bundled module, use the trusted ziphash in fips140.sum to populate its entry in the GOMODCACHE. Fixes CVE-2026-94444 For golang/go#81833 Change-Id: Ib8ebf0837e56fb8825e4526a7114b61ac843fd0b Reviewed-on: https://go-review.googlesource.com/c/go/+/840685 Reviewed-by: Filippo Valsorda <filippo@golang.org> Reviewed-by: Nicholas Husin <nsh@golang.org> Reviewed-by: Michael Pratt <mpratt@google.com> LUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: Neal Patel <nealpatel@google.com> Reviewed-by: Nicholas Husin <husin@google.com> Reviewed-by: Roland Shoemaker <roland@golang.org> Commit-Queue: Michael Pratt <mpratt@google.com>
This directory holds snapshots of the crypto/internal/fips140 tree that are being validated and certified for FIPS-140 use. The file x.txt (for example, inprocess.txt, certified.txt) defines the meaning of the FIPS version alias x, listing the exact version to use.
The zip files are created by cmd/go/internal/fips140/mkzip.go. The fips140.sum file lists checksums for the zip files. See the Makefile for recipes.