docs: flag Homebrew FIPS gap in fips-140-mode PRD

[Erik Osterman (Cloud Posse) (osterman)]

What

Documents a Homebrew-specific gap in docs/prd/fips-140-mode.md's "Where It's Wired In" table: the atmos formula in Homebrew/homebrew-core builds with a plain go build and no GOFIPS140, so brew install atmos produces a binary reporting "fips": false in atmos version --format=json, while GitHub Release binaries (built via .goreleaser.yml, which does set GOFIPS140=latest) correctly report "fips": true.

Why

atmos version --format=json showing fips: false looked like GoReleaser had regressed. Investigation confirmed GoReleaser and the local atmos build path (magefiles/build.go) both set GOFIPS140=latest correctly. The actual gap is Homebrew's from-source build, which lives entirely outside this repo. The PRD's wiring table previously claimed "every distinct Go-toolchain build invocation in the repo sets GOFIPS140" without mentioning that Homebrew isn't covered by that claim at all (it's not a build invocation in this repo), so this was an unflagged blind spot.

A fix is proposed upstream: Homebrew/homebrew-core#302847 (draft, pending Homebrew maintainer review — outside this repo's control).

References

• docs/prd/fips-140-mode.md
• internal/exec/version.go (isFIPSBuild() — reads crypto/fips140.Enabled() at runtime)
• .goreleaser.yml (sets GOFIPS140=latest for release binaries)
• Upstream fix: atmos: build with GOFIPS140=latest Homebrew/homebrew-core#302847

[atmos-pro]

Tip

Atmos Pro  

No affected stacks workflow was detected for this pull request.
If this is expected, no action is needed.
Learn More. Ask AI.

[coderabbitai]

Warning

Review limit reached

Next included review available in 11 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used all 4 included reviews currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Advanced

Run ID: 3bcc545c-784a-488a-93a0-f41422b9180e

📥 Commits

Reviewing files that changed from the base of the PR and between 82f5413 and ef8c6f3.

📒 Files selected for processing (1)

• docs/prd/fips-140-mode.md

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues found.

Scanned Files

None

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 83.90%. Comparing base (b78f8b4) to head (ef8c6f3).
⚠️ Report is 5 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #3074      +/-   ##
==========================================
+ Coverage   83.86%   83.90%   +0.04%     
==========================================
  Files        1985     1989       +4     
  Lines      194568   195577    +1009     
==========================================
+ Hits       163171   164102     +931     
- Misses      23393    23435      +42     
- Partials     8004     8040      +36     

Flag	Coverage Δ
unittests	83.90% <ø> (+0.04%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.
see 49 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.