Use native Go for Linux FIPS builds

[macdewee]

Proposed commit message

Go 1.24+ ships its own FIPS 140-3 certified crypto module (GOFIPS140), so we no longer need the Microsoft Go fork (GOEXPERIMENT=systemcrypto) which required CGO and a linked OpenSSL. This switches auditbeat, filebeat, and metricbeat Linux FIPS builds to use the native module instead.

Changes:

• fips-settings.yaml: replace GOEXPERIMENT=systemcrypto + cgo: true with GOFIPS140: v1.0.0
• crossbuild.go: stop selecting the MS Go -fips crossbuild Docker image
• build.go / settings.go: remove dead CGO field and OR
• checkFIPS() / VerifyFIPSBinary(): check GOFIPS140 + DefaultGODEBUG=fips140=on instead of GOEXPERIMENT + OpenSSL ELF symbols
• CI: switch FIPS test steps from AWS FIPS image to standard GCP image; unskip (SSH key issue was caused by OS-level FIPS enforcement, which is gone)

Mirrors elastic/elastic-agent@07f98a8.

Checklist

• My code follows the style guidelines of this project
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
• I have made corresponding change to the default configuration files
• I have added tests that prove my fix is effective or that my feature works.
• I have added an entry in ./changelog/fragments using the changelog tool.

Disruptive User Impact

FIPS binaries no longer link against system OpenSSL — no runtime OpenSSL dependency.

How to test this PR locally

cd x-pack/filebeat
FIPS=true mage Build

# check buildinfo
go version -m filebeat | grep -E 'GOFIPS140|DefaultGODEBUG'
# expect: GOFIPS140=v1.0.0-... and DefaultGODEBUG=...fips140=on...

Related issues

• Closes FIPS Integration Tests not compatible with current Git SSH keys #50269

[github-actions]

🤖 GitHub comments

Just comment with:

• run docs-build : Re-trigger the docs validation. (use unformatted text in the comment!)
• /test : Run the Buildkite pipeline.

[mergify]

This pull request does not have a backport label.
If this is a bug or security fix, could you label this PR @macdewee? 🙏.
For such, you'll need to label your PR with:

• The upcoming major version of the Elastic Stack
• The upcoming minor version of the Elastic Stack (if you're not pushing a breaking change)

To fixup this pull request, you need to add the backport labels for the needed
branches, such as:

• backport-8./d is the label to automatically backport to the 8./d branch. /d is the digit
• backport-active-all is the label that automatically backports to all active branches.
• backport-active-8 is the label that automatically backports to all active minor branches for the 8 major.
• backport-active-9 is the label that automatically backports to all active minor branches for the 9 major.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Enterprise

Run ID: 665029fb-eb6b-4d0e-a33a-6b4fda8e5e14

📥 Commits

Reviewing files that changed from the base of the PR and between 5acbbac and 53abbd3.

⛔ Files ignored due to path filters (1)

• go.sum is excluded by !**/*.sum

📒 Files selected for processing (15)

• .buildkite/libbeat/pipeline.libbeat.yml
• .buildkite/scripts/custom_fips_ech_test.sh
• .buildkite/x-pack/pipeline.xpack.filebeat.yml
• .buildkite/x-pack/pipeline.xpack.metricbeat.yml
• NOTICE.txt
• changelog/fragments/1781782084-use-native-go-for-linux-fips-builds.yaml
• dev-tools/mage/build.go
• dev-tools/mage/crossbuild.go
• dev-tools/mage/fips-settings.yaml
• dev-tools/mage/gotest.go
• dev-tools/mage/settings.go
• dev-tools/packaging/package_test.go
• go.mod
• libbeat/esleg/eslegclient/connection_test.go
• testing/go-ech/ech.go

💤 Files with no reviewable changes (1)

• dev-tools/mage/settings.go

---

📝 Walkthrough

Walkthrough

This PR migrates Linux FIPS builds from OpenSSL-based GOEXPERIMENT=systemcrypto to native Go FIPS 140 module support (GOFIPS140: v1.0.0), updating mage build/crossbuild/gotest tooling, FIPS settings schema, and binary verification logic in package_test.go and ech.go to check GOFIPS140/DefaultGODEBUG instead of ELF symbols. Buildkite pipelines for libbeat, filebeat, and metricbeat drop AWS FIPS-specific images/skip conditions and run FIPS tests on GCP. TLS connection tests gain FIPS-specific RSA-1024 rejection assertions. Also bumps elastic-agent-libs dependency and adds a changelog fragment.

Possibly related PRs

• elastic/beats#51481: Also modifies TestConnectionTLS in libbeat/esleg/eslegclient/connection_test.go, including FIPS vs non-FIPS assertions and related test certificate data.

Suggested labels: enhancement, Team:Elastic-Agent-Data-Plane

🚥 Pre-merge checks | ✅ 2

✅ Passed checks (2 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	The FIPS test steps now avoid Ubuntu 22.04 FIPS runners by switching to standard GCP images and removing the failing SSH-key dependency.
Out of Scope Changes check	✅ Passed	The changes align with the native Go FIPS migration and CI/test updates described in the PR objectives, with no clear unrelated code paths.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch drosiek-use-native-go-fips

• 🛠️ Update Documentation

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[mergify]

This pull request is now in conflicts. Could you fix it? 🙏
To fixup this pull request, you can check out it locally. See documentation: https://help.github.com/articles/checking-out-pull-requests-locally/

git fetch upstream
git checkout -b drosiek-use-native-go-fips upstream/drosiek-use-native-go-fips
git merge upstream/main
git push upstream drosiek-use-native-go-fips

[github-actions]

TL;DR

check-default failed because NOTICE.txt is stale after the PR bumped github.com/elastic/elastic-agent-libs to v0.44.1-0.20260701084740-d72ff2012311. Regenerate and commit NOTICE.txt, then rerun the check-default workflow.

Remediation

• From the repo root on branch drosiek-use-native-go-fips, run make notice and commit the resulting NOTICE.txt update.
• Re-run make check-default locally or rerun the GitHub Actions check-default workflow after pushing; the check should no longer fail at check-no-changes for NOTICE.txt.

Investigation details

Root Cause

The PR changes go.mod from github.com/elastic/elastic-agent-libs v0.44.0 to github.com/elastic/elastic-agent-libs v0.44.1-0.20260701084740-d72ff2012311, and go.sum is updated accordingly, but NOTICE.txt is not part of the PR file list. During make check-default, the notice target regenerated NOTICE.txt; the later check-no-changes target failed because that generated diff was uncommitted.

Evidence

• Workflow: https://github.com/elastic/beats/actions/runs/28512384913
• Job/step: check / Run check-default
• Key log excerpt:

Generating NOTICE
go mod tidy
...
go list -m -json all | go run go.elastic.co/go-licence-detector \
	-includeIndirect \
	-rules dev-tools/notice/rules.json \
	-overrides dev-tools/notice/overrides.json \
	-noticeTemplate dev-tools/notice/NOTICE.txt.tmpl \
	-noticeOut NOTICE.txt \
	-depsOut ""
...
diff --git a/NOTICE.txt b/NOTICE.txt
@@ -10798,11 +10798,11 @@ SOFTWARE
 Dependency : github.com/elastic/elastic-agent-libs
-Version: v0.44.0
+Version: v0.44.1-0.20260701084740-d72ff2012311
 Licence type (autodetected): Apache-2.0
...
-Contents of probable licence file $GOMODCACHE/github.com/elastic/elastic-agent-libs@v0.44.0/LICENSE:
+Contents of probable licence file $GOMODCACHE/github.com/elastic/elastic-agent-libs@v0.44.1-0.20260701084740-d72ff2012311/LICENSE:
NOTICE.txt: needs update
make[1]: *** [Makefile:119: check-no-changes] Error 1
make: *** [Makefile:107: check-default] Error 2

Validation

• Not run locally; this was a workflow-log investigation. I checked the PR file list and confirmed NOTICE.txt is not included while go.mod/go.sum contain the dependency bump.

Follow-up

• The prior PR Actions Detective report on this PR covered different golangci-lint failures from an older workflow run, so this is a new report rather than a duplicate.

---

What is this? | From workflow: PR Actions Detective

Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not.

[ebeahan]

@macdewee let's make sure someone from @elastic/elastic-agent-data-plane also gives a proper review since my membership dismissed 😄

[fr4nc1sc0-r4m0n]

The CI changes LGTM

[mergify]

Queued — the merge queue status continues in this comment ↓.

[mergify]

Merge Queue Status

• ✅ Entered queue — 2026-07-03 11:50 UTC · Rule: default · triggered by @macdewee with the merge queue checkbox
• ❌ Checks failed · on draft merge queue: checking main (c2c559c) and #51345 together #51710
• 🚫 Left the queue — 2026-07-03 12:07 UTC · at 53abbd3610b69a7cd38ca6907e055fd2bf38a5ec

This pull request spent 17 minutes 46 seconds in the queue, including 17 minutes 17 seconds running CI.

Waiting for

• check-success=buildkite/beats
• any of: [🛡 GitHub branch protection]
  • check-neutral = buildkite/beats
  • check-skipped = buildkite/beats
  • check-success = buildkite/beats

All conditions

• check-success=buildkite/beats
• any of [🛡 GitHub branch protection]:
  • check-neutral = buildkite/beats
  • check-skipped = buildkite/beats
  • check-success = buildkite/beats
• #review-threads-unresolved = 0 [🛡 GitHub branch protection]
  • Use native Go for Linux FIPS builds #51345
• check-success=CLA
• github-review-approved [🛡 GitHub branch protection]
  • Use native Go for Linux FIPS builds #51345
• github-review-approved [🛡 GitHub repository ruleset rule [org] Require a PR for Renovate]
  • Use native Go for Linux FIPS builds #51345
• github-review-approved [🛡 GitHub repository ruleset rule [org] Require a PR]
  • Use native Go for Linux FIPS builds #51345
• github-review-decision = APPROVED [🛡 GitHub branch protection]
  • Use native Go for Linux FIPS builds #51345
• any of [🛡 GitHub branch protection]:
  • check-success = CLA
  • check-neutral = CLA
  • check-skipped = CLA

Reason

The merge conditions cannot be satisfied due to failing checks

• buildkite/beats
• CLA

Failing checks:

• ❌ buildkite/beats

Hint

You may have to fix your CI before adding the pull request to the queue again.
If you update this pull request, to fix the CI, it will automatically be requeued once the queue conditions match again.
If you think this was a flaky issue instead, you can requeue the pull request, without updating it, by posting a @mergifyio queue comment.

Tick the box to put this pull request back in the merge queue (same as @mergifyio queue).

• Requeue this pull request

[github-actions]

TL;DR

Metricbeat Run check/update failed because metricbeat/mb/module/runner_test.go:173 passes logptest.NewTestingLogger(t, "") directly to module.NewWrapper, but module.NewWrapper now expects *beat.Info as its third argument. This appears to be from the current main merge-queue base commit (c2c559cd, #50834), not from the FIPS changes in this PR.

Remediation

• Change metricbeat/mb/module/runner_test.go:173 to match the other calls in the same file, e.g. pass &beat.Info{Logger: logptest.NewTestingLogger(t, "")} as the third module.NewWrapper argument.
• Validate with go test ./metricbeat/mb/module or rerun make -C metricbeat check update.

Investigation details

Root Cause

module.NewWrapper is declared at metricbeat/mb/module/wrapper.go:93 as:

func NewWrapper(config *conf.C, r *mb.Register, info *beat.Info, monitoring beatmonitoring.Monitoring, p *paths.Path, options ...Option) (*Wrapper, error)

Most calls in metricbeat/mb/module/runner_test.go already pass &beat.Info{Logger: logptest.NewTestingLogger(t, "")} (metricbeat/mb/module/runner_test.go:57 and metricbeat/mb/module/runner_test.go:85), but the new runner-stop test still passes only the logger at metricbeat/mb/module/runner_test.go:173.

Evidence

• Build: https://buildkite.com/elastic/beats/builds/48814
• Job/step: Metricbeat: Run check/update
• Command: make -C metricbeat check update && make check-no-changes
• Key log excerpt:

# github.com/elastic/beats/v7/metricbeat/mb/module_test
# [github.com/elastic/beats/v7/metricbeat/mb/module_test]
vet: mb/module/runner_test.go:173:51: cannot use logptest.NewTestingLogger(t, "") (value of type *logp.Logger) as *beat.Info value in argument to module.NewWrapper
Error: failed running go vet, please fix the issues reported: running "go vet ./..." failed with exit code 1

I also reproduced the package compile failure locally:

$ go test ./metricbeat/mb/module
# github.com/elastic/beats/v7/metricbeat/mb/module_test [github.com/elastic/beats/v7/metricbeat/mb/module.test]
metricbeat/mb/module/runner_test.go:173:51: cannot use logptest.NewTestingLogger(t, "") (value of type *logp.Logger) as *beat.Info value in argument to module.NewWrapper
FAIL	github.com/elastic/beats/v7/metricbeat/mb/module [build failed]

Verification

• Ran go test ./metricbeat/mb/module; it fails at compile time with the same module.NewWrapper argument mismatch.
• Did not apply the fix locally because this detective workflow is read-only.

Follow-up

Since the failing line comes from c2c559cd ([metricbeat] fix race condtion on runner closure (#50834)) on the merge-queue base, this should be fixed on main or the merge queue should be retried after that fix lands.

---

What is this? | From workflow: PR Buildkite Detective

Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not.

[github-actions]

@Mergifyio backport 9.5 9.4 9.3

[mergify]

backport 9.5 9.4 9.3

✅ Backports have been created

Details

• #51951 [9.5](backport #51345) Use native Go for Linux FIPS builds has been created for branch 9.5 but encountered conflicts

Cherry-pick of a829d56 has failed:

On branch mergify/bp/9.5/pr-51345
Your branch is up to date with 'origin/9.5'.

You are currently cherry-picking commit a829d56a0.
  (fix conflicts and run "git cherry-pick --continue")
  (use "git cherry-pick --skip" to skip this patch)
  (use "git cherry-pick --abort" to cancel the cherry-pick operation)

Unmerged paths:
  (use "git add <file>..." to mark resolution)
	both modified:   .buildkite/libbeat/pipeline.libbeat.yml
	both modified:   .buildkite/x-pack/pipeline.xpack.filebeat.yml
	both modified:   .buildkite/x-pack/pipeline.xpack.metricbeat.yml

no changes added to commit (use "git add" and/or "git commit -a")

To fix up this pull request, you can check it out locally. See documentation: https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/checking-out-pull-requests-locally

• #51952 [9.4](backport #51345) Use native Go for Linux FIPS builds has been created for branch 9.4
• #51953 [9.3](backport #51345) Use native Go for Linux FIPS builds has been created for branch 9.3 but encountered conflicts

Cherry-pick of a829d56 has failed:

On branch mergify/bp/9.3/pr-51345
Your branch is up to date with 'origin/9.3'.

You are currently cherry-picking commit a829d56a0.
  (fix conflicts and run "git cherry-pick --continue")
  (use "git cherry-pick --skip" to skip this patch)
  (use "git cherry-pick --abort" to cancel the cherry-pick operation)

Changes to be committed:
	modified:   .buildkite/scripts/custom_fips_ech_test.sh
	modified:   NOTICE.txt
	new file:   changelog/fragments/1781782084-use-native-go-for-linux-fips-builds.yaml
	modified:   dev-tools/mage/build.go
	modified:   dev-tools/mage/crossbuild.go
	modified:   dev-tools/mage/fips-settings.yaml
	modified:   dev-tools/mage/gotest.go
	modified:   dev-tools/mage/settings.go
	modified:   dev-tools/packaging/package_test.go
	modified:   go.mod
	modified:   go.sum
	modified:   libbeat/esleg/eslegclient/connection_test.go
	modified:   testing/go-ech/ech.go

Unmerged paths:
  (use "git add <file>..." to mark resolution)
	both modified:   .buildkite/libbeat/pipeline.libbeat.yml
	both modified:   .buildkite/x-pack/pipeline.xpack.filebeat.yml
	both modified:   .buildkite/x-pack/pipeline.xpack.metricbeat.yml

To fix up this pull request, you can check it out locally. See documentation: https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/checking-out-pull-requests-locally

[github-actions]

@Mergifyio backport 9.5 9.4 9.3 8.19

[github-actions]

@Mergifyio backport 9.5 9.4 9.3 8.19