Follow up native Go FIPS migration; clean up missed leftovers (#14986)

* Follow up native Go FIPS migration: remove dead msft-go artefacts and tighten test assertion

- Remove MS_GOTOOLCHAIN_TELEMETRY_ENABLED from the FIPS integration pipeline and magefile.go Windows archive build; both Linux and Windows FIPS now use GOFIPS140 (native Go), so the Microsoft toolchain env var is dead code.
- Remove the msft-go toolchain smoke-check from buildkite-integration-tests.sh; the check was specific to GOEXPERIMENT=systemcrypto and is no longer meaningful.
- Remove CGO field from FIPSConfig.Compile and its use in DefaultBuildArgs; native Go FIPS does not require CGO.
- Propagate FIPS compile env vars (e.g. GOFIPS140) into Go test args so unit tests run with the same crypto constraints as packaged binaries.
- Change GOFIPS140 test assertion from require.Contains(..., "v1.0.0") to require.Equal so it fails loudly on any version mismatch.
- Update tls.go comment to reference GOFIPS140 instead of the removed GOEXPERIMENT paths.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* test: assert prefix rather than exact match for GOFIPS140 env

Signed-off-by: Dominik Rosiek <dominik.rosiek@elastic.co>

* Bump elastic-agent-libs to v0.46.0 and add FIPS test coverage for makeGoTestArgs

Picks up elastic/elastic-agent-libs#426 (enforce FIPS 140-3 peer cert key
types across all TLS verification modes), mirroring the native-Go FIPS
migration landing in elastic/beats#51345. Replaces a local filesystem
replace directive used to validate against that PR before it merged.

Also adds TestMakeGoTestArgsFIPS covering the FIPS env propagation added
in the prior follow-up commit.

* docs: add changelog fragment for FIPS TLS cert key-type fix

Documents the customer-facing fix (elastic-agent-libs v0.46.0 bump) where
FIPS mode was silently accepting TLS peer certificates with non-approved
key types due to a native Go FIPS gap with custom verify callbacks.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* Apply suggestion from @macdewee

---------

Signed-off-by: Dominik Rosiek <dominik.rosiek@elastic.co>
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: macdewee

.buildkite/bk.integration-fips.pipeline.yml

@@ -2,7 +2,6 @@
 
 env:
   ASDF_MAGE_VERSION: 1.14.0
-  MS_GOTOOLCHAIN_TELEMETRY_ENABLED: "0"
 
   IMAGE_UBUNTU_2404_X86_64: "platform-ingest-elastic-agent-ubuntu-2404-1782867684"
   IMAGE_UBUNTU_X86_64_FIPS: "platform-ingest-elastic-agent-ubuntu-2204-fips-1782867684"

.buildkite/scripts/buildkite-integration-tests.sh

@@ -17,11 +17,6 @@ if [ -z "$TEST_SUDO" ]; then
   exit 1
 fi
 
-if [ "${FIPS:-false}" == "true" ]; then
-  echo "~~~FIPS: Checking msft-go is installed"
-  GOEXPERIMENT=systemcrypto go version
-fi
-
 if [ "$TEST_SUDO" == "true" ]; then
   echo "Re-initializing ASDF. The user is changed to root..."
   export ASDF_DATA_DIR="/opt/buildkite-agent/.asdf"

changelog/fragments/1783087904-fips-builds-reject-non-approved-tls-peer-cert-key-types.yaml

@@ -0,0 +1,45 @@
+# REQUIRED
+# Kind can be one of:
+# - breaking-change: a change to previously-documented behavior
+# - deprecation: functionality that is being removed in a later release
+# - bug-fix: fixes a problem in a previous version
+# - enhancement: extends functionality but does not break or fix existing behavior
+# - feature: new functionality
+# - known-issue: problems that we are aware of in a given version
+# - security: impacts on the security of a product or a user’s deployment.
+# - upgrade: important information for someone upgrading from a prior version
+# - other: does not fit into any of the other categories
+kind: bug-fix
+
+# REQUIRED for all kinds
+# Change summary; a 80ish characters long description of the change.
+summary: Fixed FIPS mode accepting non-compliant TLS certificates
+
+# REQUIRED for breaking-change, deprecation, known-issue
+# Long description; in case the summary is not enough to describe the change
+# this field accommodate a description without length limits.
+# description:
+
+# REQUIRED for breaking-change, deprecation, known-issue
+# impact:
+
+# REQUIRED for breaking-change, deprecation, known-issue
+# action:
+
+# REQUIRED for all kinds
+# Affected component; usually one of "elastic-agent", "fleet-server", "filebeat", "metricbeat", "auditbeat", "all", etc.
+component: elastic-agent
+
+# AUTOMATED
+# OPTIONAL to manually add other PR URLs
+# PR URL: A link the PR that added the changeset.
+# If not present is automatically filled by the tooling finding the PR where this changelog fragment has been added.
+# NOTE: the tooling supports backports, so it's able to fill the original PR number instead of the backport PR number.
+# Please provide it if you are adding a fragment for a different PR.
+# pr: https://github.com/owner/repo/1234
+
+# AUTOMATED
+# OPTIONAL to manually add other issue URLs
+# Issue URL; optional; the GitHub issue related to this changeset (either closes or is part of).
+# If not present is automatically filled by the tooling with the issue linked to the PR number.
+# issue: https://github.com/owner/repo/1234

dev-tools/mage/build.go

@@ -106,7 +106,6 @@ func DefaultBuildArgs(cfg *Settings) BuildArgs {
 			for _, tag := range fipsConfig.Compile.Tags {
 				args.ExtraFlags = append(args.ExtraFlags, "-tags="+tag)
 			}
-			args.CGO = args.CGO || fipsConfig.Compile.CGO
 			for varName, value := range fipsConfig.Compile.Env {
 				args.Env[varName] = value
 			}

dev-tools/mage/gotest.go

@@ -19,6 +19,7 @@ import (
 	"github.com/magefile/mage/sh"
 
 	"github.com/elastic/elastic-agent/dev-tools/mage/gotool"
+	"github.com/elastic/elastic-agent/dev-tools/packaging"
 )
 
 // GoTestArgs are the arguments used for the "go*Test" targets and they define
@@ -52,6 +53,9 @@ func makeGoTestArgs(cfg *Settings, name string) GoTestArgs {
 		params.CoverageProfileFile = fileName + ".cov"
 	}
 	if cfg.Build.FIPSBuild {
+		for k, v := range packaging.Settings().FIPS.Compile.Env {
+			params.Env[k] = v
+		}
 		// fips140=only causes the Go runtime to reject non-FIPS algorithms.
 		// tlsmlkem=0 disables X25519MLKEM768 (uses X25519, which is not FIPS-compliant).
 		// Both are set here rather than in the shell environment so that they apply

dev-tools/mage/gotest_test.go

@@ -357,3 +357,45 @@ var wantTestWithWrongPanic = `(?sm:
 .*
 panic: Fail in goroutine after TestGoTest_Helper_WithWrongPanic/setup_failing_go-routine has completed.*
 )`
+
+func TestMakeGoTestArgsFIPS(t *testing.T) {
+	t.Run("FIPS disabled: no FIPS env vars injected", func(t *testing.T) {
+		s := DefaultSettings()
+		s.Build.FIPSBuild = false
+
+		args := makeGoTestArgs(s, "Unit")
+
+		assert.NotContains(t, args.Tags, "requirefips")
+		assert.NotContains(t, args.Env, "GOFIPS140")
+		assert.NotContains(t, args.Env, "GODEBUG")
+	})
+
+	t.Run("FIPS enabled: requirefips tag added", func(t *testing.T) {
+		s := DefaultSettings()
+		s.Build.FIPSBuild = true
+
+		args := makeGoTestArgs(s, "Unit")
+
+		assert.Contains(t, args.Tags, "requirefips")
+	})
+
+	t.Run("FIPS enabled: compile env from packages.yml propagated", func(t *testing.T) {
+		s := DefaultSettings()
+		s.Build.FIPSBuild = true
+
+		args := makeGoTestArgs(s, "Unit")
+
+		// packages.yml sets GOFIPS140=v1.0.0 under fips.compile.env;
+		// makeGoTestArgs must forward every key from that map.
+		assert.Equal(t, "v1.0.0", args.Env["GOFIPS140"])
+	})
+
+	t.Run("FIPS enabled: GODEBUG enforces FIPS-only runtime", func(t *testing.T) {
+		s := DefaultSettings()
+		s.Build.FIPSBuild = true
+
+		args := makeGoTestArgs(s, "Unit")
+
+		assert.Equal(t, "fips140=only,tlsmlkem=0", args.Env["GODEBUG"])
+	})
+}

dev-tools/packaging/settings.go

@@ -197,7 +197,6 @@ func (p Platform) Platform() string {
 
 type FIPSConfig struct {
 	Compile struct {
-		CGO       bool              `yaml:"cgo"`
 		Env       map[string]string `yaml:"env"`
 		Tags      []string          `yaml:"tags"`
 		Platforms []Platform        `yaml:"platforms"`

dev-tools/packaging/testing/package_test.go

@@ -877,7 +877,8 @@ func checkFIPS(t *testing.T, agentPackageRootDir string) {
 					continue
 				case "GOFIPS140":
 					foundFIPS = true
-					require.NotEmpty(t, setting.Value, "GOFIPS140 must be set in binary build info")
+					// Go embeds a commit hash suffix (e.g. v1.0.0-c2097c7c), so check by prefix.
+					require.True(t, strings.HasPrefix(setting.Value, "v1.0.0"), "GOFIPS140 must reference the certified module version v1.0.0, got: %s", setting.Value)
 					continue
 				case "DefaultGODEBUG":
 					if strings.Contains(setting.Value, "fips140=on") {

internal/edot/receivers/verifierreceiver/internal/verifier/tls.go

@@ -25,10 +25,9 @@ var fipsCurves = []tls.CurveID{tls.CurveP256, tls.CurveP384}
 // AWS STS, Azure Entra ID (login.microsoftonline.com), and all *.googleapis.com.
 //
 // Full binary-level FIPS compliance also requires building with
-// GOEXPERIMENT=systemcrypto (RHEL) or GOEXPERIMENT=boringcrypto, which
-// replaces the standard Go crypto library with a FIPS 140-validated
-// implementation. The TLS settings here provide defence-in-depth and are
-// effective regardless of build mode.
+// GOFIPS140=v1.0.0, which uses Go's native FIPS 140-3 certified crypto module.
+// The TLS settings here provide defence-in-depth and are effective regardless
+// of build mode.
 func newHTTPClient() *http.Client {
 	var transport *http.Transport
 	if t, ok := http.DefaultTransport.(*http.Transport); ok {

magefile.go

@@ -299,7 +299,6 @@ func (Build) windowsArchiveRootBinaryForGoArch(ctx context.Context, goarch strin
 			// there is no actual FIPS relevance for this particular binary
 			// but better safe than sorry
 			args.ExtraFlags = append(args.ExtraFlags, "-tags=requirefips")
-			args.Env["MS_GOTOOLCHAIN_TELEMETRY_ENABLED"] = "0"
 			args.CGO = true
 		}
 	}